Mozilla Firefox Wizz RSS News Reader Extension Cross-Context Scripting

Posted on Wednesday, April 18, 2007 @ 00:33:43 PDT in Security
by raven

SECUNIA ADVISORY ID: SA24913

VERIFY ADVISORY: http://secunia.com/advisories/24913/

CRITICAL: Highly critical

IMPACT: Cross Site Scripting, System access

WHERE: >From remote

SOFTWARE: Wizz RSS News Reader (Extension for Mozilla Firefox) 2.x - http://secunia.com/product/13955/

DESCRIPTION: A vulnerability has been reported in the Wizz RSS News Reader extension for Mozilla Firefox, which can be exploited by malicious people to compromise a vulnerable system.

Certain input is not properly sanitised before being used and can be exploited to e.g. execute arbitrary script code within the "chrome:" context. Successful exploitation requires that a user is tricked into loading a specially crafted RSS feed. The vulnerability is reported in versions prior to 2.1.9.

SOLUTION: Update to version 2.1.9. - https://addons.mozilla.org/en-US/firefox/addon/424

PROVIDED AND/OR DISCOVERED BY: The vendor credits Jefferson Ogata, NOAA Computer Incident Response Team.

ORIGINAL ADVISORY: Wizz RSS News Reader: - https://addons.mozilla.org/en-US/firefox/addon/424

OTHER REFERENCES: US-CERT VU#319464: http://www.kb.cert.org/vuls/id/319464
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 352,674,183
  • Today: 64,140
Server InfoServer Info
  • Apr 20, 2018
  • 05:14 pm PDT
 
 

Daily Inspiration