Vulnerability Details : CVE-2010-2762
The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
Exploit prediction scoring system (EPSS) score for CVE-2010-2762
Probability of exploitation activity in the next 30 days: 1.44%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 85 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-2762
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2010-2762
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-2762
-
http://www.securityfocus.com/bid/43092
Mozilla Firefox and Thunderbird 'XPCSafeJSObjectWrapper' Chrome Privilege Escalation Vulnerability
-
http://www.vupen.com/english/advisories/2010/2323
Webmail | OVH- OVH
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11492
Repository / Oval Repository
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/61656
Mozilla Firefox and Thunderbird SJOW code execution CVE-2010-2762 Vulnerability Report
- http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
-
http://www.mozilla.org/security/announce/2010/mfsa2010-59.html
SJOW creates scope chains ending in outer object — MozillaVendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html
[security-announce] SUSE Security Announcement: Mozilla Firefox (SUSE-SA
-
http://www.mandriva.com/security/advisories?name=MDVSA-2010:173
mandriva.com
-
https://bugzilla.mozilla.org/show_bug.cgi?id=584180
584180 - (CVE-2010-2762) SJOWs create scope chains ending in outer objects
-
http://www.vupen.com/english/advisories/2011/0061
Webmail | OVH- OVH
-
http://support.avaya.com/css/P8/documents/100112690
ASA-2010-263 (RHSA-2010-0681)
Products affected by CVE-2010-2762
- cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:3.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:3.1:*:*:*:*:*:*:*