[Japanese]

JVNDB-2008-000021

Mozilla Firefox cross-site scripting vulnerability

Overview

Mozilla Firefox web browser contains a cross-site scripting vulnerability.

Mozilla Firefox does not properly handle certain HTML documents in Shift_JIS encoding. According to MFSA 2008-13, this flaw could potentially be used to evade web-site input filters and result in a XSS attack hazard.
CVSS Severity (What is CVSS?)

Base Metrics: 2.6 (Low) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: None
  • Integrity Impact: Partial
  • Availability Impact: None

Affected Products


mozilla.org contributors
  • Mozilla Firefox prior to 2.0.0.12
Sun Microsystems, Inc.
  • OpenSolaris (SPARC)
  • OpenSolaris (x86)
  • Sun Solaris 10 (SPARC)
  • Sun Solaris 10 (x86)
Turbolinux, Inc.
  • Turbolinux 11 Server
  • Turbolinux 11 Server x64 Edition
  • Turbolinux FUJI
  • wizpy
Red Hat, Inc.
  • Red Hat Desktop (v.3)
  • Red Hat Desktop (v.4)
  • Red Hat Enterprise Linux (v.5 server)
  • Red Hat Enterprise Linux AS (v.2.1)
  • Red Hat Enterprise Linux AS (v.3)
  • Red Hat Enterprise Linux AS (v.4)
  • Red Hat Enterprise Linux Desktop (v.5 client)
  • Red Hat Enterprise Linux ES (v.2.1)
  • Red Hat Enterprise Linux ES (v.3)
  • Red Hat Enterprise Linux ES (v.4)
  • Red Hat Enterprise Linux WS (v.2.1)
  • Red Hat Enterprise Linux WS (v.3)
  • Red Hat Enterprise Linux WS (v.4)
  • Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
  • RHEL Desktop Workstation (v.5 client)

Impact

An arbitrary script may be executed on the user's web browser.
Solution

[Update the Software]
Update to the latest version according to the information provided by the vendor.
Vendor Information

mozilla.org contributors Sun Microsystems, Inc.
  • Sun Alert Notification : 238492
  • Sun Alert Notification : 239546
Turbolinux, Inc. Red Hat, Inc.
CWE (What is CWE?)

  1. Cross-site Scripting(CWE-79) [NVD Evaluation]
CVE (What is CVE?)

  1. CVE-2008-0416
References

  1. JVN : JVN#21563357
  2. National Vulnerability Database (NVD) : CVE-2008-0416
  3. SecurityFocus : 29303
Revision History

[2008/05/21]
  Web page published
[2008/06/23]
  Affected Products : Added Sun Microsystems, Inc. (238492).
  Vendor Information : Added Sun Microsystems, Inc. (238492).
[2008/07/29]
  Vendor Information : Sun Microsystems, Inc (239546).