CVE-2010-1207

Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1 do not properly implement read restrictions for CANVAS elements, which allows remote attackers to obtain sensitive cross-origin information via vectors involving reference retention and node deletion.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
mozillafirefox
𝑥
≤ 3.6.6
mozillafirefox
3.6
mozillafirefox
3.6.2
mozillafirefox
3.6.3
mozillafirefox
3.6.4
mozillathunderbird
𝑥
≤ 3.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
lucid
Fixed 3.6.7+build2+nobinonly-0ubuntu0.10.04.1
released
karmic
dne
jaunty
dne
hardy
ignored
dapper
ignored
firefox-3.0
lucid
dne
karmic
dne
jaunty
Fixed 3.6.7+build2+nobinonly-0ubuntu0.9.04.1
released
hardy
Fixed 3.6.7+build2+nobinonly-0ubuntu0.8.04.1
released
dapper
dne
firefox-3.5
lucid
dne
karmic
Fixed 3.6.7+build2+nobinonly-0ubuntu0.9.10.1
released
jaunty
ignored
hardy
dne
dapper
dne
xulrunner-1.9.2
lucid
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.10.04.1
released
karmic
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.9.10.2
released
jaunty
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.9.04.2
released
hardy
Fixed 1.9.2.7+build2+nobinonly-0ubuntu0.8.04.2
released
dapper
dne
Common Weakness Enumeration
References
http://www.mozilla.org/security/announce/2010/mfsa2010-43.html
https://bugzilla.mozilla.org/show_bug.cgi?id=571287
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11887
http://www.mozilla.org/security/announce/2010/mfsa2010-43.html
https://bugzilla.mozilla.org/show_bug.cgi?id=571287
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11887