CVE-2010-1215: Code Injection

Published Jul 30, 2010

Updated

Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 do not properly implement access to a content object through a SafeJSObjectWrapper (aka SJOW) wrapper, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging "access to an object from the chrome scope."

Affected Software

6 affected components

Mozilla Firefox=3.6.2

Mozilla Firefox=3.6.3

Mozilla Firefox=3.6.6

Mozilla Firefox=3.6.1

Mozilla Firefox=3.6.4

Mozilla Thunderbird=3.1

Event History

Jul 30, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-1215?

CVE-2010-1215 is categorized as a critical severity vulnerability due to its potential for remote code execution with elevated privileges.

How do I fix CVE-2010-1215?

To fix CVE-2010-1215, update Mozilla Firefox to version 3.6.7 or later, or Thunderbird to version 3.1.1 or later.

What kind of vulnerability is CVE-2010-1215?

CVE-2010-1215 is a JavaScript execution vulnerability that allows attackers to execute arbitrary code with chrome privileges.

Which software versions are affected by CVE-2010-1215?

CVE-2010-1215 affects Mozilla Firefox versions 3.6.1 through 3.6.6 and Thunderbird version 3.1 and earlier.

Can CVE-2010-1215 be exploited remotely?

Yes, CVE-2010-1215 can be exploited remotely, enabling attackers to execute arbitrary JavaScript on affected systems.