Mozilla security researcher moz_bug_r_a4 reported that it is possible to create a document whose URI does not match the document's principal using XMLHttpRequest. This type of mismatch leads to incorrect results in principal-based security checks. An attacker could use this vulnerability to execute arbitrary JavaScript within the context of another site. moz_bug_r_a4 separately reported that XPCNativeWrapper.toString's __proto__ comes from the wrong scope which results in calls to that function being executed in the wrong context in certain circumstances. An attacker could use this vulnerability to run arbitrary code within the context of a different site. Alternatively, if chrome were to call content.toString.call(), then attacker-defined functions could be run with chrome privileges.
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 2.1 Via RHSA-2009:0437 https://rhn.redhat.com/errata/RHSA-2009-0437.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2009:0436 https://rhn.redhat.com/errata/RHSA-2009-0436.html
xulrunner-1.9.0.9-1.fc9, firefox-3.0.9-1.fc9, epiphany-extensions-2.22.1-10.fc9, epiphany-2.22.2-10.fc9, blam-1.8.5-8.fc9.1, chmsee-1.0.1-11.fc9, devhelp-0.19.1-11.fc9, evolution-rss-0.1.0-10.fc9, galeon-2.0.7-9.fc9, gnome-python2-extras-2.19.1-26.fc9, gnome-web-photo-0.3-20.fc9, google-gadgets-0.10.5-5.fc9, gtkmozembedmm-1.4.2.cvs20060817-28.fc9, kazehakase-0.5.6-4.fc9.1, Miro-2.0.3-3.fc9, mozvoikko-0.9.5-9.fc9, mugshot-1.2.2-8.fc9, ruby-gnome2-0.17.0-8.fc9, totem-2.23.2-14.fc9, yelp-2.22.1-11.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
xulrunner-1.9.0.9-1.fc10, firefox-3.0.9-1.fc10, epiphany-extensions-2.24.0-7.fc10, epiphany-2.24.3-5.fc10, blam-1.8.5-9.fc10, devhelp-0.22-7.fc10, galeon-2.0.7-9.fc10, gecko-sharp2-0.13-7.fc10, gnome-python2-extras-2.19.1-29.fc10, gnome-web-photo-0.3-17.fc10, google-gadgets-0.10.5-5.fc10, kazehakase-0.5.6-4.fc10.1, Miro-2.0.3-3.fc10, mozvoikko-0.9.5-9.fc10, mugshot-1.2.2-8.fc10, pcmanx-gtk2-0.3.8-8.fc10, perl-Gtk2-MozEmbed-0.08-5.fc10.2, ruby-gnome2-0.18.1-5.fc10.1, yelp-2.24.0-8.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:1126 https://rhn.redhat.com/errata/RHSA-2009-1126.html
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2009:1125 https://rhn.redhat.com/errata/RHSA-2009-1125.html