Mozilla Firefox 3.6.x < 3.6.3 RCE

Medium Nessus Network Monitor Plugin ID 5502

Synopsis

The remote host has a web browser installed that is vulnerable to a remote code execution attack.

Description

The remote host is running a version of Mozilla Firefox 3.6.x prior to 3.6.3. Such versions are potentially affected by a memory corruption flaw caused by the re-use of a freed object when moving DOM nodes between documents. A remote attacker, exploiting this flaw, could execute arbitrary code on the remote host subject to the privileges of the user running the affected application.

Solution

Upgrade to Firefox 3.6.3 or later.

See Also

http://www.mozilla.org/security/announce/2010/mfsa2010-25.html

Plugin Details

Severity: Medium

ID: 5502

File Name: 5502.prm

Family: Web Clients

Published: 2010/04/02

Modified: 2016/03/12

Dependencies: 9131

Nessus ID: 45403

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5.6

Temporal Score: 5.2

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Patch Publication Date: 2010/04/01

Vulnerability Publication Date: 2010/04/01

Reference Information

CVE: CVE-2010-1121

BID: 38952

OSVDB: 63457