Vulnerability Note VU#319464
The Wizz RSS Reader chrome access vulnerability
The Wizz RSS Reader contains a vulnerability that may allow an attacker to take any action that Mozlla Firefox can.
The Mozilla Firefox user interface components outside of the content area are created using chrome. This includes toolbars, menu bars, progress bars, and window title bars. Chrome provides content, locale, and skin information for the user interface. The Wizz RSS reader is an extension to Mozilla Firefox that searches and displays RSS feeds.
A remote unauthenticated attacker may be able to take any action that Mozilla Firefox is capable of performing. This includes downloading arbitrary files, redirecting browser requests, and access stored passwords.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Wizz Computers||Affected||23 Mar 2007||16 Apr 2007|
CVSS Metrics (Learn More)
Thanks to the N-CIRT Lab for reporting this vulnerability.
This document was written by Ryan Giobbi.
- CVE IDs: Unknown
- Date Public: 13 Apr 2007
- Date First Published: 16 Apr 2007
- Date Last Updated: 17 Apr 2007
- Severity Metric: 3.27
- Document Revision: 20
If you have feedback, comments, or additional information about this vulnerability, please send us email.