Mozilla Firefox Custom Cursor May Let Remote Users Spoof Portions of the User Interface
|
|
SecurityTracker Alert ID: 1017700
|
|
SecurityTracker URL: http://securitytracker.com/id?1017700
|
|
CVE Reference: CVE-2007-0779
(Links to External Site)
|
Date: Feb 24 2007
|
Impact: Modification of system information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Mozilla Foundation Security Advisory
|
Version(s): 1.5.x prior to 1.5.0.10, also 2.0, 2.0.0.1
|
Description: A vulnerability was reported in Mozilla Firefox. A remote user may be able to spoof elements of the user interface.
A remote user can create a large, mostly transparent, custom cursor and adjust the CSS3 hotspot property to cause the visible part
of the cursor to float outside of the browser content area. This may allow the remote user to spoof certain user interface elements,
including the hostname and security indicators.
David Eckel reported this vulnerability.
|
Impact: A remote user may be able to spoof elements of the user interface.
|
Solution: The vendor has issued a fix (1.5.0.10, 2.0.0.2).
The Mozilla advisory is available at:
http://www.mozilla.org/security/announce/2007/mfsa2007-04.html
|
Vendor URL: www.mozilla.org/security/announce/2007/mfsa2007-04.html (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 24 Feb 2007 01:39:03 -0500
Subject: Mozilla Firefox
|
http://www.mozilla.org/security/announce/2007/mfsa2007-04.html
CVE-2007-0779
|
|
