Bug 179170

Summary:	CVE-2006-0296 XULDocument.persist() RDF data injection
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	mozilla	Assignee:	Christopher Aillon <caillon>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ben Levenson <benl>
Severity:	high	Docs Contact:
Priority:	medium
Version:	4	CC:	deisenst, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=important,embargo=20060202,reported=20060127,source=mozilla
Fixed In Version:	mozilla-1.7.12-1.5.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-02-26 09:53:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2006-01-27 21:04:51 UTC

XULDocument.persist() RDF data injection

XULDocument.persist() function doesn't verify whether the second
argument is a valid attribute name.  Thus, an attacker can inject
bogus RDF data into localstore.rdf in order to run arbitrary
javascript.

https://bugzilla.mozilla.org/show_bug.cgi?id=319847

Comment 2 Fedora Update System 2006-02-02 23:35:33 UTC

From User-Agent: XML-RPC

mozilla-1.7.12-1.5.2 has been pushed for FC4, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.

Comment 3 David Eisenstein 2006-02-26 09:43:34 UTC

Should this bug as well as bug 179164 and bug 179167 be closed ERRATA, since
the packages have been pushed to updates?

Comment 4 David Eisenstein 2006-02-26 09:53:19 UTC

Closing this bug CURRENTRELEASE.

Update announcement FEDORA-2006-075 for this issue is at:
http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00005.html

Comment 5 David Eisenstein 2006-04-22 07:43:04 UTC

Forgive the bug-spam.  Just checking something, regarding bug # 189589.