Information disclosure in Mozilla Firefox
CVE-2010-0654
Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
Vulnerability class: Information Disclosure
EPSS: 0.019 (77.1th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions 3.5.2, 3.5.1, 3.5.9
- Mozilla Seamonkey — versions 1.0.9, 1.1.1, 1.1.12
- Mozilla Thunderbird — versions 3.0.1, 3.0.5, 3.0.3
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (x_refsource_OVAL, signature, vdb-entry)