CVE-2010-1197

Published: Jun 24, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.

Affected (58)

Products: Mozilla: Firefox, Seamonkey

2 products

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 3.5.1
Mozilla Firefox	Version 3.5.2
Mozilla Firefox	Version 3.5.3
Mozilla Firefox	Version 3.5.4
Mozilla Firefox	Version 3.5.5
Mozilla Firefox	Version 3.5.6
Mozilla Firefox	Version 3.5.7
Mozilla Firefox	Version 3.5.9
Mozilla Firefox	Version 3.5

Configuration B

46 vulnerable

Vulnerable Software	Affected Versions
Mozilla Seamonkey	Up to 2.0.4
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.14
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.16
Mozilla Seamonkey	Version 1.1.17
Mozilla Seamonkey	Version 1.1.18
Mozilla Seamonkey	Version 1.1.19
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Seamonkey	Version 2.0.1
Mozilla Seamonkey	Version 2.0.2
Mozilla Seamonkey	Version 2.0.3
Mozilla Seamonkey	Version 2.0
Mozilla Seamonkey	Version 2.0 alpha_1
Mozilla Seamonkey	Version 2.0 alpha_2
Mozilla Seamonkey	Version 2.0 alpha_3
Mozilla Seamonkey	Version 2.0 beta_1
Mozilla Seamonkey	Version 2.0 beta_2
Mozilla Seamonkey	Version 2.0 rc1
Mozilla Seamonkey	Version 2.0 rc2

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 3.6.2
Mozilla Firefox	Version 3.6.3
Mozilla Firefox	Version 3.6

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (54)

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html

Source: cve@mitre.org

http://secunia.com/advisories/40326

Source: cve@mitre.org

http://secunia.com/advisories/40401

Source: cve@mitre.org

http://secunia.com/advisories/40481

Source: cve@mitre.org

http://support.avaya.com/css/P8/documents/100091069

Source: cve@mitre.org

http://ubuntu.com/usn/usn-930-1

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2010:125

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2010/mfsa2010-32.html

Source: cve@mitre.org

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0499.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2010-0500.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2010-0501.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/41050

Source: cve@mitre.org

http://www.securityfocus.com/bid/41103

Source: cve@mitre.org

http://www.securitytracker.com/id?1024138

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-930-2

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/1551

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/1556

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/1557

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/1592

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/1640

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/1773

Source: cve@mitre.org

https://bugzilla.mozilla.org/show_bug.cgi?id=537120

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/59667

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10168

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14186

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40326

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40401

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40481

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.avaya.com/css/P8/documents/100091069

Source: af854a3a-2127-422b-91ae-364da2661108

http://ubuntu.com/usn/usn-930-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2010:125

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2010/mfsa2010-32.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0499.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2010-0500.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2010-0501.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/41050

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/41103

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1024138

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/usn-930-2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/1551

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/1556

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/1557

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/1592

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/1640

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/1773

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=537120

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/59667

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10168

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14186

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.