CVE-2010-0182
Published: 5 April 2010
The XMLDocument::load function in Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4 does not perform the expected nsIContentPolicy checks during loading of content by XML documents, which allows attackers to bypass intended access restrictions via crafted content.
Priority
Low
Status
| Package | Release | Status |
|---|---|---|
|
firefox Launchpad, Ubuntu, Debian |
dapper |
Ignored
(reached end-of-life)
|
| hardy |
Ignored
(uses system xulrunner)
|
|
| intrepid |
Does not exist
|
|
| jaunty |
Does not exist
|
|
| karmic |
Does not exist
|
|
| lucid |
Released
(3.6.3+nobinonly-0ubuntu2)
|
|
| maverick |
Released
(3.6.3+nobinonly-0ubuntu2)
|
|
| natty |
Released
(3.6.3+nobinonly-0ubuntu2)
|
|
| oneiric |
Released
(3.6.3+nobinonly-0ubuntu2)
|
|
| upstream |
Released
(3.6.3)
|
|
|
seamonkey Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Released
(2.0.8+build1+nobinonly-0ubuntu0.8.04.1)
|
|
| intrepid |
Needed
(reached end-of-life)
|
|
| jaunty |
Released
(2.0.8+build1+nobinonly-0ubuntu0.9.04.1)
|
|
| karmic |
Released
(2.0.8+build1+nobinonly-0ubuntu0.9.10.1)
|
|
| lucid |
Released
(2.0.8+build1+nobinonly-0ubuntu0.10.04.1)
|
|
| maverick |
Not vulnerable
(2.0.4+nobinonly-0ubuntu1)
|
|
| natty |
Not vulnerable
(2.0.4+nobinonly-0ubuntu1)
|
|
| oneiric |
Not vulnerable
(2.0.4+nobinonly-0ubuntu1)
|
|
| upstream |
Released
(2.0.4)
|
|
|
thunderbird Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Ignored
|
|
| intrepid |
Needed
(reached end-of-life)
|
|
| jaunty |
Ignored
|
|
| karmic |
Ignored
|
|
| lucid |
Released
(3.0.4+nobinonly-0ubuntu1)
|
|
| maverick |
Released
(3.0.4+nobinonly-0ubuntu1)
|
|
| natty |
Released
(3.0.4+nobinonly-0ubuntu1)
|
|
| oneiric |
Released
(3.0.4+nobinonly-0ubuntu1)
|
|
| upstream |
Released
(3.0.4)
|
|
|
xulrunner Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Ignored
(reached end-of-life)
|
|
| intrepid |
Needed
(reached end-of-life)
|
|
| jaunty |
Ignored
(reached end-of-life)
|
|
| karmic |
Ignored
(reached end-of-life)
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
xulrunner-1.9 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Ignored
|
|
| intrepid |
Needed
(reached end-of-life)
|
|
| jaunty |
Ignored
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(1.9.0.19)
|
|
|
xulrunner-1.9.1 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| intrepid |
Does not exist
|
|
| jaunty |
Released
(1.9.1.9+nobinonly-0ubuntu0.9.04.1)
|
|
| karmic |
Released
(1.9.1.9+nobinonly-0ubuntu0.9.10.1)
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(1.9.1.9)
|
Notes
| Author | Note |
|---|---|
| jdstrand | CVEs in Firefox are tracked in the xulrunner source packages. The mapping of xulrunner sources to firefox is: xulrunner (1.8.0): firefox (1.5) - Ubuntu 6.06 LTS xulrunner (1.8.1): firefox (2.0) - Ubuntu 6.10 - 8.04 LTS xulrunner-1.9: firefox-3.0 xulrunner-1.9.1: firefox-3.5 Ubuntu 6.06 LTS and 10.04 LTS uses the embedded xulrunner and not the system xulrunner-1.9.2, so it is tracked in the firefox source package. |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0182
- https://ubuntu.com/security/notices/USN-921-1
- NVD
- Launchpad
- Debian