JVN#21563357
Mozilla Firefox cross-site scripting vulnerability
Overview
Mozilla Firefox web browser contains a cross-site scripting vulnerability.
Products Affected
- Firefox prior to 2.0.0.12
Other applications such as Thunderbird and SeaMonkey that use Mozilla components may also be affected.
For more information, refer to the vendor's website.
Description
Mozilla Firefox does not properly handle certain HTML documents in Shift_JIS encoding. According to MFSA 2008-13, this flaw could potentially be used to evade web-site input filters and result in a XSS attack hazard.
Impact
An arbitrary script may be executed on the user's web browser.
Solution
Update the Software
Update to the latest version according to the information provided by the vendor.
Vendor Status
| Vendor | Link |
| Mozilla Foundation |
Mozilla Foundation Security Advisory 2008-13 |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Analyzed on 2008.04.04
| Measures | Conditions | Severity |
|---|---|---|
| Access Required | Routed - can be attacked over the Internet using packets |
|
| Authentication | None - anonymous or no authentication (IP addresses do not count) |
|
| User Interaction Required | Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file |
|
| Exploit Complexity | Low - little to no expertise and/or luck required to exploit (cross-site scripting) |
|
Credit
NetAgent Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory | |
| CPNI Advisory | |
| TRnotes | |
| CVE | |
| JVN iPedia |
JVNDB-2008-000021 |