CVE-2010-0162

NameCVE-2010-0162
DescriptionMozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly support the application/octet-stream content type as a protection mechanism against execution of web script in certain circumstances involving SVG and the EMBED element, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via an embedded SVG document.
SourceCVE (at NVD; LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1999-1
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
iceweasel (PTS)wheezy38.5.0esr-1~deb7u2fixed
wheezy (security)38.8.0esr-1~deb7u1fixed
jessie38.7.1esr-1~deb8u1fixed
jessie (security)38.8.0esr-1~deb8u1fixed
xulrunner (PTS)wheezy (security), wheezy24.8.1esr-2~deb7u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceapesource(unstable)2.0.3-1medium
iceapesourcelenny(not affected)
iceweaselsource(unstable)3.5.11-2medium
iceweaselsourcelenny(not affected)
xulrunnersource(unstable)1.9.1.8-1medium
xulrunnersourceetch(unfixed)end-of-life
xulrunnersourcelenny1.9.0.18-1mediumDSA-1999-1

Notes

[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[lenny] - iceape <not-affected> (Lenny package only provide xpcom stubs)

Search for package or bug name: Reporting problems