CVE-2010-0179

Description

Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response.

Category

5.1
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 0.73% Top 30%
Vendor Advisory opensuse.org Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory securitytracker.com Vendor Advisory mozilla.org Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory vupen.com Vendor Advisory vupen.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00002.html vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:251 vendor advisory
http://support.avaya.com/css/P8/documents/100124650
https://exchange.xforce.ibmcloud.com/vulnerabilities/57394 vdb entry
http://secunia.com/advisories/39397 third party advisory vendor advisory
http://secunia.com/advisories/39308 third party advisory vendor advisory
http://secunia.com/advisories/42818 third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6971 vdb entry signature
http://www.vupen.com/english/advisories/2010/0781 vdb entry vendor advisory
http://ubuntu.com/usn/usn-921-1 vendor advisory
http://www.securityfocus.com/bid/39124 vdb entry
https://bugzilla.mozilla.org/show_bug.cgi?id=504021
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html vendor advisory
http://www.vupen.com/english/advisories/2010/0764 vdb entry vendor advisory
http://www.vupen.com/english/advisories/2011/0030 vdb entry
http://www.mandriva.com/security/advisories?name=MDVSA-2010:070 vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9446 vdb entry signature
http://www.mozilla.org/security/announce/2010/mfsa2010-21.html vendor advisory
http://secunia.com/advisories/39243 third party advisory vendor advisory
http://www.vupen.com/english/advisories/2010/0748 vdb entry vendor advisory
http://www.vupen.com/english/advisories/2010/0849 vdb entry vendor advisory
http://securitytracker.com/id?1023783 vdb entry vendor advisory
http://www.debian.org/security/2010/dsa-2027 vendor advisory
http://secunia.com/advisories/3924 third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2010-0332.html vendor advisory

Frequently Asked Questions

What is the severity of CVE-2010-0179?
CVE-2010-0179 has been scored as a medium severity vulnerability.
How to fix CVE-2010-0179?
To fix CVE-2010-0179, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2010-0179 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2010-0179 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.