CVE-2010-0654

Published: 18 February 2010

Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.

Notes

CVEs in Firefox are tracked in the xulrunner source packages. The
mapping of xulrunner sources to firefox is:
xulrunner (1.8.0): firefox (1.5) - Ubuntu 6.06 LTS
xulrunner (1.8.1): firefox (2.0) - Ubuntu 6.10 - 8.04 LTS
xulrunner-1.9: firefox-3.0
xulrunner-1.9.1: firefox-3.5
Ubuntu 6.06 LTS and 10.04 LTS uses the embedded xulrunner and not
the system xulrunner-1.9.2, so it is tracked in the firefox source package.
per chriscoulson, tbird requires javascript

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0654
• https://ubuntu.com/security/notices/USN-930-4
• https://ubuntu.com/security/notices/USN-957-1
• https://ubuntu.com/security/notices/USN-958-1
• NVD
• Launchpad
• Debian

Bugs

• http://code.google.com/p/chromium/issues/detail?id=9877