Mozilla Firefox LoadScript Code Execution Vulnerability

Publish date: July 21, 2015
  Severity: MEDIUM
  CVE Identifier: CVE-2008-2803
  Advisory Date: JUL 21, 2015

  DESCRIPTION

The mozIJSSubScriptLoader.LoadScript function in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 does not apply XPCNativeWrappers to scripts loaded from (1) file: URIs, (2) data: URIs, or (3) certain non-canonical chrome: URIs, which allows remote attackers to execute arbitrary code via vectors involving third-party add-ons.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1002616
  Trend Micro Deep Security DPI Rule Name: 1002616 - Mozilla Firefox mozIJSSubScriptLoader.loadSubScript() Arbitrary Code Execution

  AFFECTED SOFTWARE AND VERSION

  • mozilla firefox 2.0
  • mozilla firefox 2.0.0.1
  • mozilla firefox 2.0.0.10
  • mozilla firefox 2.0.0.11
  • mozilla firefox 2.0.0.12
  • mozilla firefox 2.0.0.13
  • mozilla firefox 2.0.0.14
  • mozilla firefox 2.0.0.2
  • mozilla firefox 2.0.0.3
  • mozilla firefox 2.0.0.4
  • mozilla firefox 2.0.0.5
  • mozilla firefox 2.0.0.6
  • mozilla firefox 2.0.0.8
  • mozilla firefox 2.0.0.7
  • mozilla firefox 2.0.0.9
  • mozilla seamonkey 1.1
  • mozilla seamonkey 1.1.2
  • mozilla seamonkey 1.1.3
  • mozilla seamonkey 1.1.4
  • mozilla seamonkey 1.1.5
  • mozilla seamonkey 1.1.6
  • mozilla seamonkey 1.1.7
  • mozilla seamonkey 1.1.8
  • mozilla seamonkey 1.1.9
  • mozilla thunderbird 2.0.0.1
  • mozilla thunderbird 2.0.0.0
  • mozilla thunderbird 2.0.0.11
  • mozilla thunderbird 2.0.0.12
  • mozilla thunderbird 2.0.0.13
  • mozilla thunderbird 2.0.0.14
  • mozilla thunderbird 2.0.0.2
  • mozilla thunderbird 2.0.0.3
  • mozilla thunderbird 2.0.0.4
  • mozilla thunderbird 2.0.0.5
  • mozilla thunderbird 2.0.0.6
  • mozilla thunderbird 2.0.0.8
  • mozilla thunderbird 2.0.0.9

Featured Stories