CVE-2010-3773: Medium severity Mozilla Firefox vulnerability
Published Dec 10, 2010
·Updated
Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-0179.
Affected Software
173 affected components
Mozilla Firefox=3.6.2
Mozilla Firefox=3.6.3
Mozilla Firefox=3.6.11
Mozilla Firefox=3.6.8
Mozilla Firefox=3.6.9
Mozilla Firefox=3.6.12
Mozilla Firefox=3.6.6
Mozilla Firefox=3.6.10
Mozilla Firefox=3.6.7
Mozilla Firefox=3.6.4
Mozilla Firefox=3.6
Mozilla SeaMonkey=1.1.10
Mozilla SeaMonkey=1.0.3
Mozilla SeaMonkey=1.1.8
Mozilla SeaMonkey=1.0.1
Mozilla SeaMonkey=1.1.7
Mozilla SeaMonkey=1.5.0.10
Mozilla SeaMonkey=1.0.6
Mozilla SeaMonkey=1.0.9
Mozilla SeaMonkey=1.1.3
Mozilla SeaMonkey=2.0.4
Mozilla SeaMonkey=1.0
Mozilla SeaMonkey=2.0.3
Mozilla SeaMonkey=2.0.2
Mozilla SeaMonkey=1.1.17
Mozilla SeaMonkey=2.0-alpha_2
Mozilla SeaMonkey=1.1.5
Mozilla SeaMonkey=2.0.8
Mozilla SeaMonkey=1.0.7
Mozilla SeaMonkey=1.0-beta
Mozilla SeaMonkey=1.1-alpha
Mozilla SeaMonkey=2.0-rc2
Mozilla SeaMonkey=2.0-alpha_3
Mozilla SeaMonkey=1.0-alpha
Mozilla SeaMonkey=1.1.12
Mozilla SeaMonkey=1.1
Mozilla SeaMonkey=1.1.14
Mozilla SeaMonkey=1.1.2
Mozilla SeaMonkey=2.0-beta_2
Mozilla SeaMonkey=1.0.2
Mozilla SeaMonkey=1.0.8
Mozilla SeaMonkey=1.1.11
Mozilla SeaMonkey=2.0-alpha_1
Mozilla SeaMonkey=1.5.0.9
Mozilla SeaMonkey=1.1-beta
Mozilla SeaMonkey=1.1.1
Mozilla SeaMonkey=2.0.9
Mozilla SeaMonkey=1.5.0.8
Mozilla SeaMonkey=2.0.1
Mozilla SeaMonkey=1.0.5
Mozilla SeaMonkey=1.1.15
Mozilla SeaMonkey=1.1.6
Mozilla SeaMonkey=2.0.7
Mozilla SeaMonkey=1.1.16
Mozilla SeaMonkey=2.0-beta_1
Mozilla SeaMonkey=1.1.19
Mozilla SeaMonkey=2.0.5
Mozilla SeaMonkey<=2.0.10
Mozilla SeaMonkey=2.0-rc1
Mozilla SeaMonkey=1.0.4
Mozilla SeaMonkey=1.1.9
Mozilla SeaMonkey=1.1.13
Mozilla SeaMonkey=1.1.18
Mozilla SeaMonkey=2.0.6
Mozilla SeaMonkey=2.0
Mozilla SeaMonkey=1.1.4
Mozilla Firefox=0.1
Mozilla Firefox=0.8
Mozilla Firefox=2.0.0.12
Mozilla Firefox=1.5-beta2
Mozilla Firefox=3.0.17
Mozilla Firefox=3.5.3
Mozilla Firefox=3.0.7
Mozilla Firefox=1.5.2
Mozilla Firefox=3.0.9
Mozilla Firefox=1.5.0.6
Mozilla Firefox=1.8
Mozilla Firefox=2.0.0.2
Mozilla Firefox=1.5.0.10
Mozilla Firefox=1.5.0.3
Mozilla Firefox=3.5.6
Mozilla Firefox=3.0.8
Mozilla Firefox=1.5.0.11
Mozilla Firefox=1.4.1
Mozilla Firefox=1.5.4
Mozilla Firefox=1.0.2
Mozilla Firefox=3.5
Mozilla Firefox=3.5.5
Mozilla Firefox=3.0.4
Mozilla Firefox=1.5-beta1
Mozilla Firefox=3.5.9
Mozilla Firefox=3.5.4
Mozilla Firefox=3.5.7
Mozilla Firefox=3.0.5
Mozilla Firefox=3.5.11
Mozilla Firefox=1.5
Mozilla Firefox=0.9.1
Mozilla Firefox=3.5.14
Mozilla Firefox=1.0.4
Mozilla Firefox=2.0.0.7
Mozilla Firefox=1.0.7
Mozilla Firefox=3.5.10
Mozilla Firefox=3.5.1
Mozilla Firefox=2.0.0.9
Mozilla Firefox=0.10.1
Mozilla Firefox=3.0.14
Mozilla Firefox=3.5.2
Mozilla Firefox=0.9
Mozilla Firefox=2.0.0.16
Mozilla Firefox=1.5.6
Mozilla Firefox=2.0.0.17
Mozilla Firefox=0.7
Mozilla Firefox=2.0.0.15
Mozilla Firefox=3.0.10
Mozilla Firefox=0.2
Mozilla Firefox=0.3
Mozilla Firefox=3.0.12
Mozilla Firefox=1.0
Mozilla Firefox=3.0.3
Mozilla Firefox=1.5.0.7
Mozilla Firefox=2.0
Mozilla Firefox=1.0.1
Mozilla Firefox=2.0.0.14
Mozilla Firefox=0.6
Mozilla Firefox=0.7.1
Mozilla Firefox=3.0.6
Mozilla Firefox=3.0.15
Mozilla Firefox=1.5.0.8
Mozilla Firefox=2.0.0.3
Mozilla Firefox=3.5.12
Mozilla Firefox=1.5.0.9
Mozilla Firefox=1.5.0.5
Mozilla Firefox=1.5.7
Mozilla Firefox=1.5.0.12
Mozilla Firefox=2.0.0.6
Mozilla Firefox=3.0
Mozilla Firefox=2.0.0.11
Mozilla Firefox=1.5.0.2
Mozilla Firefox=1.0.3
Mozilla Firefox=3.0.1
Mozilla Firefox=2.0.0.4
Mozilla Firefox=0.5
Mozilla Firefox=0.6.1
Mozilla Firefox=1.5.1
Mozilla Firefox<=3.5.15
Mozilla Firefox=0.9.3
Mozilla Firefox=2.0.0.13
Mozilla Firefox=2.0.0.18
Mozilla Firefox=3.5.13
Mozilla Firefox=2.0.0.1
Mozilla Firefox=3.0.2
Mozilla Firefox=3.5.8
Mozilla Firefox=1.5.5
Mozilla Firefox=0.9.2
Mozilla Firefox=1.0-preview_release
Mozilla Firefox=2.0.0.20
Mozilla Firefox=2.0.0.8
Mozilla Firefox=0.9-rc
Mozilla Firefox=2.0.0.19
Mozilla Firefox=1.5.8
Mozilla Firefox=1.5.3
Mozilla Firefox=0.4
Mozilla Firefox=1.5.0.4
Mozilla Firefox=1.5.0.1
Mozilla Firefox=3.0.13
Mozilla Firefox=0.10
Mozilla Firefox=1.0.5
Mozilla Firefox=2.0.0.5
Mozilla Firefox=2.0.0.10
Mozilla Firefox=1.0.6
Mozilla Firefox=3.0.16
Mozilla Firefox=1.0.8
Mozilla Firefox=3.0.11
Event History
Dec 10, 2010
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-3773?
CVE-2010-3773 has a medium severity rating and can potentially allow remote code execution.
2
How do I fix CVE-2010-3773?
To fix CVE-2010-3773, update Mozilla Firefox to version 3.5.16 or later, or SeaMonkey to version 2.0.11 or later.
3
What versions are affected by CVE-2010-3773?
CVE-2010-3773 affects Mozilla Firefox versions prior to 3.5.16 and 3.6.x prior to 3.6.13, as well as various versions of SeaMonkey.
4
Who is impacted by CVE-2010-3773?
Users of outdated versions of Mozilla Firefox and SeaMonkey are vulnerable to CVE-2010-3773.
5
What is the exploit vector for CVE-2010-3773?
CVE-2010-3773 is exploited through the XMLHttpRequestSpy module in the Firebug add-on, allowing interactivity with chrome privileged objects.