JVNDB-2008-000021

Mozilla Firefox cross-site scripting vulnerability

Mozilla Firefox web browser contains a cross-site scripting vulnerability.

Mozilla Firefox does not properly handle certain HTML documents in Shift_JIS encoding. According to MFSA 2008-13, this flaw could potentially be used to evade web-site input filters and result in a XSS attack hazard.

Base Metrics: 2.6 (Low) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

mozilla.org contributors

• Mozilla Firefox prior to 2.0.0.12

Sun Microsystems, Inc.

• OpenSolaris (SPARC)
• OpenSolaris (x86)
• Sun Solaris 10 (SPARC)
• Sun Solaris 10 (x86)

Turbolinux, Inc.

• Turbolinux 11 Server
• Turbolinux 11 Server x64 Edition
• Turbolinux FUJI
• wizpy

Red Hat, Inc.

• Red Hat Desktop (v.3)
• Red Hat Desktop (v.4)
• Red Hat Enterprise Linux (v.5 server)
• Red Hat Enterprise Linux AS (v.2.1)
• Red Hat Enterprise Linux AS (v.3)
• Red Hat Enterprise Linux AS (v.4)
• Red Hat Enterprise Linux Desktop (v.5 client)
• Red Hat Enterprise Linux ES (v.2.1)
• Red Hat Enterprise Linux ES (v.3)
• Red Hat Enterprise Linux ES (v.4)
• Red Hat Enterprise Linux WS (v.2.1)
• Red Hat Enterprise Linux WS (v.3)
• Red Hat Enterprise Linux WS (v.4)
• Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
• RHEL Desktop Workstation (v.5 client)

An arbitrary script may be executed on the user's web browser.

[Update the Software]
Update to the latest version according to the information provided by the vendor.

mozilla.org contributors

• Mozilla Foundation Security Advisory : MFSA 2008-13

Sun Microsystems, Inc.

• Sun Alert Notification : 238492
• Sun Alert Notification : 239546

Turbolinux, Inc.

• Turbolinux Security Advisory : TLSA-2008-9

Red Hat, Inc.

• Red Hat Security Advisory : RHSA-2008:0103
• Red Hat Security Advisory : RHSA-2008:0104

1. JVN : JVN#21563357
2. National Vulnerability Database (NVD) : CVE-2008-0416
3. Common Vulnerabilities and Exposures (CVE) : CVE-2008-0416
4. SecurityFocus : 29303
5. Common Weakness Enumeration (CWE) : Cross-site scripting (CWE-79) [NVD Evaluation]

[2008/05/21]
  Web page published
[2008/06/23]
  Affected Products : Added Sun Microsystems, Inc. (238492).
  Vendor Information : Added Sun Microsystems, Inc. (238492).
[2008/07/29]
  Vendor Information : Sun Microsystems, Inc (239546).