Bug 576694 (CVE-2010-0169)

Summary:	CVE-2010-0169 firefox/thunderbird/seamonkey: browser chrome defacement via cached XUL stylesheets (MFSA 2010-14)
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	desktop-bugs, gecko-bugs-nobody, gecko-bugs-nobody, mjc
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0169
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-03-24 22:04:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2010-03-24 20:58:04 UTC

Mozilla developer Wladimir Palant reported that stylesheets used in remote
XUL documents can wind up in the XUL cache where it can later be accessed
by browser chrome for use in styling the user interface. A malicious
website could use this issue to pollute a user's XUL cache and change style
attributes of their browser such as font size and color.

Comment 1 Vincent Danen 2010-03-24 21:01:17 UTC

Upstream advisory:

http://www.mozilla.org/security/announce/2010/mfsa2010-14.html

This was fixed in upstream Firefox 3.0.18, and via RHSA-2010:0112 in Red Hat Enterprise Linux 4 and 5.

https://rhn.redhat.com/errata/RHSA-2010-0112.html

Comment 2 Vincent Danen 2010-03-24 22:04:16 UTC

A patch was applied to correct this in Red Hat Enterprise Linux 3 and 4 (Seamonkey) via RHSA-2010:0113:

https://rhn.redhat.com/errata/RHSA-2010-0113.html

A patch was applied to correct this in Red Hat Enterprise Linux 4 (Thunderbird) via RHSA-2010:0154:

https://rhn.redhat.com/errata/RHSA-2010-0154.html

A patch was applied to correct this in Red Hat Enterprise Linux 5 (Thunderbird) via RHSA-2010:0153:

https://rhn.redhat.com/errata/RHSA-2010-0153.html