Red Hat Bugzilla – Bug 751930
CVE-2011-3004 Mozilla: loadSubScript is unwrapping XPCNativeWrapper scope parameter (MFSA 2011-43)
Last modified: 2013-04-12 11:56:17 EDT
A potentially exploitable flaw was found in the way mozilla handled "loadSubScript".
David Rees reported that the JSSubScriptLoader (a feature used by some add-ons) was "unwrapping" XPCNativeWrappers when they were used as the scope parameter to loadSubScript(). Without the protection of the wrappers the add-on could be vulnerable to privilege escalation attacks from malicious web content. Whether any given add-on were vulnerable would depend on how the add-on used the feature and whether it interacted directly with web content, but we did find at least one vulnerable add-on and presume there are more.
The unwrapping behavior was a change introduced during Firefox 4 development. Firefox 3.6 and earlier versions are not affected.
Not vulnerable. This issue did not affect the versions of firefox as shipped with Red Hat Enterprise Linux 5 or 6.