Vulnerability Note VU#405092
Mozilla products contain a cross-site scripting vulnerability due to a vulnerability in the way IMG elements are loaded.
A vulnerability in the way Mozilla products load IMG elements in a frame may cause a cross-site script injection. According to Mozilla Foundation Security Advisory 2006-72:
By convincing a victim to view an HTML document (web page), an attacker could evaluate script in a different security domain than the one containing the attacker's document. The attacker could read or modify data in other web sites (read cookies/content, modify/create content, etc.). If the script is evaluated with chrome privileges, an attacker could execute arbitrary commands on the user's system.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Debian GNU/Linux||Affected||-||05 Mar 2007|
|Fedora Project||Affected||-||18 Jan 2007|
|Gentoo Linux||Affected||-||18 Jan 2007|
|Mandriva, Inc.||Affected||-||18 Jan 2007|
|Mozilla||Affected||-||21 Dec 2006|
|Red Hat, Inc.||Affected||-||18 Jan 2007|
|rPath||Affected||-||18 Jan 2007|
|Slackware Linux Inc.||Affected||-||18 Jan 2007|
|SUSE Linux||Affected||-||18 Jan 2007|
|Ubuntu||Affected||-||18 Jan 2007|
CVSS Metrics (Learn More)
This vulnerability was reported in Mozilla Foundation Security Advisory 2006-72. Mozilla credits moz_bug_r_a4 with providing information about this issue.
This document was written by Chris Taschner.
- CVE IDs: CVE-2006-6503
- Date Public: 19 Dec 2006
- Date First Published: 18 Jan 2007
- Date Last Updated: 05 Mar 2007
- Severity Metric: 10.26
- Document Revision: 25
If you have feedback, comments, or additional information about this vulnerability, please send us email.