- Description
- The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6 before 3.6.2 does not apply scheme restrictions and policy restrictions to the image's URL, which might allow remote attackers to cause a denial of service (application crash or hang) or hijack the functionality of the browser's add-ons via a crafted SRC attribute of an IMG element, as demonstrated by remote command execution through an ssh: URL in a configuration that supports gnome-vfs with a nonstandard network.gnomevfs.supported-protocols setting.
- Source
- cve@mitre.org
- NVD status
- Modified
CVSS 2.0
- Type
- Primary
- Base score
- 7.6
- Impact score
- 10
- Exploitability score
- 4.9
- Vector string
- AV:N/AC:H/Au:N/C:C/I:C/A:C
- nvd@nist.gov
- CWE-264
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3782354-7EB7-49D2-B240-1871F6CB84C7"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:3.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39A968C1-8F61-4A26-A098-84F9A4DD5D3B"
}
],
"operator": "OR"
}
]
}
]