CVE-2010-2751

NameCVE-2010-2751
DescriptionThe nsDocShell::OnRedirectStateChange function in docshell/base/nsDocShell.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to spoof the SSL security status of a document via vectors involving multiple requests, a redirect, and the history.back and history.forward JavaScript functions.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2075-1
NVD severitylow (attack range: remote, user-initiated)
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
iceape (PTS)squeeze (security)2.0.11-17fixed
iceweasel (PTS)squeeze (security), squeeze3.5.16-20fixed
wheezy31.3.0esr-1~deb7u1fixed
wheezy (security)31.5.0esr-1~deb7u1fixed
jessie, sid31.5.0esr-1fixed
xulrunner (PTS)wheezy, wheezy (security)24.8.1esr-2~deb7u1fixed

The information above is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceapesource(unstable)2.0.6-1low
iceapesourcelenny(not affected)
iceweaselsource(unstable)3.5.11-2low
iceweaselsourcelenny(not affected)
xulrunnersource(unstable)1.9.1.11-1low
xulrunnersourcelenny1.9.0.19-3lowDSA-2075-1

Notes

[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[lenny] - iceape <not-affected> (Only a stub package)

Search for package or bug name: Reporting problems