CVE-2010-1207

EUVD-2010-1237
Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1 do not properly implement read restrictions for CANVAS elements, which allows remote attackers to obtain sensitive cross-origin information via vectors involving reference retention and node deletion.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
≤ 3.6.6
mozillafirefox
3.6
mozillafirefox
3.6.2
mozillafirefox
3.6.3
mozillafirefox
3.6.4
mozillathunderbird
𝑥
≤ 3.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
dapper
ignored
hardy
ignored
jaunty
dne
karmic
dne
lucid
Fixed 3.6.7+build2+nobinonly-0ubuntu0.10.04.1
released
firefox-3.0
dapper
dne
hardy
Fixed 3.6.7+build2+nobinonly-0ubuntu0.8.04.1
released
jaunty
Fixed 3.6.7+build2+nobinonly-0ubuntu0.9.04.1
released
karmic
dne
lucid
dne
firefox-3.5
dapper
dne
hardy
dne
jaunty
ignored
karmic
Fixed 3.6.7+build2+nobinonly-0ubuntu0.9.10.1
released
lucid
dne
xulrunner-1.9.2
dapper
dne
hardy
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.8.04.2
released
jaunty
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.9.04.2
released
karmic
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.9.10.2
released
lucid
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.10.04.1
released
Common Weakness Enumeration
References
http://www.mozilla.org/security/announce/2010/mfsa2010-43.html
https://bugzilla.mozilla.org/show_bug.cgi?id=571287
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11887
http://www.mozilla.org/security/announce/2010/mfsa2010-43.html
https://bugzilla.mozilla.org/show_bug.cgi?id=571287
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11887