Bug 602059 (CVE-2010-1990)

Summary:	CVE-2010-1990 firefox/seamonkey: mail application launch when IFRAME element has a mailto: URI in its SRC attribute
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caillon, gecko-bugs-nobody, kengert
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-06-28 18:05:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2010-06-09 04:22:39 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-1990 to
the following vulnerability:

Name: CVE-2010-1990
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1990
Assigned: 20100520
Reference: BUGTRAQ:20100518 DoS vulnerabilities in Firefox, Internet Explorer, Chrome, Opera and other browsers
Reference: URL: http://www.securityfocus.com/archive/1/archive/1/511327/100/0/threaded
Reference: MISC: http://websecurity.com.ua/4206/

Mozilla Firefox 3.6.x, 3.5.x, 3.0.19, and earlier, and SeaMonkey,
executes a mail application in situations where an IFRAME element has
a mailto: URL in its SRC attribute, which allows remote attackers to
cause a denial of service (excessive application launches) via an HTML
document with many IFRAME elements.

Comment 1 Vincent Danen 2010-06-28 18:05:03 UTC

Statement:

The Red Hat Security Response Team does not consider a user assisted denial of service (and potential crash) of end user application, such a Firefox, to be a security issue.