675087 – (CVE-2011-0051) CVE-2011-0051 Mozilla recursive eval call causes confirm dialog to evaluate to true (MFSA 2011-02)

Bug 675087 (CVE-2011-0051) - CVE-2011-0051 Mozilla recursive eval call causes confirm dialog to evaluate to true (MFSA 2011-02)

Summary: CVE-2011-0051 Mozilla recursive eval call causes confirm dialog to evaluate t...

Keywords:
Status:	CLOSED ERRATA
Alias:	CVE-2011-0051
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	urgent
Severity:	urgent
Target Milestone:	---
Assignee:	Red Hat Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2011-02-04 09:10 UTC by Huzaifa S. Sidhpurwala
Modified:	2019-09-29 12:42 UTC (History)
CC List:	2 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2013-04-12 21:43:00 UTC
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2011:0310	normal	SHIPPED_LIVE	Critical: firefox security and bug fix update	2011-03-02 01:09:43 UTC
Red Hat Product Errata	RHSA-2011:0312	normal	SHIPPED_LIVE	Moderate: thunderbird security update	2011-03-02 01:20:51 UTC
Red Hat Product Errata	RHSA-2011:0313	normal	SHIPPED_LIVE	Critical: seamonkey security update	2011-03-02 01:31:18 UTC

Description Huzaifa S. Sidhpurwala 2011-02-04 09:10:44 UTC

Security researcher Zach Hoffman reported that a recursive call 
to eval() wrapped in a try/catch statement places the browser 
into a inconsistent state. Any dialog box opened in this state is 
displayed without text and with non-functioning buttons. 
Closing the window causes the dialog to evaluate to true. 

An attacker could use this issue to force a user into accepting 
any dialog, such as one granting elevated privileges to the page 
presenting the dialog.

Comment 1 Vincent Danen 2011-03-01 23:18:02 UTC

This is now public:

http://www.mozilla.org/security/announce/2011/mfsa2011-02.html

Comment 2 errata-xmlrpc 2011-03-02 01:10:01 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2011:0310 https://rhn.redhat.com/errata/RHSA-2011-0310.html

Comment 3 errata-xmlrpc 2011-03-02 01:21:03 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2011:0312 https://rhn.redhat.com/errata/RHSA-2011-0312.html

Comment 4 errata-xmlrpc 2011-03-02 01:31:32 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2011:0313 https://rhn.redhat.com/errata/RHSA-2011-0313.html

Note You need to log in before you can comment on or make changes to this bug.