Mozilla Firefox/Thunderbird/SeaMonkey – Multiple HTML Injection Vulnerabilities

• Exploit Database
• 60 阅读

• 作者： Yosuke Hasegawa
  日期： 2010-12-09
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/35095/

• source: https://www.securityfocus.com/bid/45353/info
  
  Mozilla Firefox, SeaMonkey, and Thunderbird are prone to multiple HTML-injection vulnerabilities.
  
  Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
  
  This issue is fixed in:
  
  Firefox 3.6.13
  Firefox 3.5.16
  SeaMonkey 2.0.11
  
  x-mac-farsi exploit: <meta charset="x-mac-farsi">?script ?alert(1)//?/script ?