CVE-2010-0169

firefox/thunderbird/seamonkey: browser chrome defacement via cached XUL stylesheets (MFSA 2010-14)

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The CSSLoaderImpl::DoSheetComplete function in layout/style/nsCSSLoader.cpp in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3 changes the case of certain strings in a stylesheet before adding this stylesheet to the XUL cache, which might allow remote attackers to modify the browser's font and other CSS attributes, and potentially disrupt rendering of a web page, by forcing the browser to perform this erroneous stylesheet caching.

La función CSSLoaderImpl::DoSheetComplete en layout/style/nsCSSLoader.cpp en Mozilla Firefox v3.0.x anterior a v3.0.18, v3.5.x anterior a v3.5.8, y v3.6.x anterior a v3.6.2; Thunderbird anterior a v3.0.2; y SeaMonkey anterior a v2.0.3 cambia la caja de ciertas cadenas en la hoja de estilos antes de añadirla a la cache XUL, lo que permite a atacantes remotos modificar las fuentes del navegador y otros atributos CSS, y potencialmente interrumpir el renderizado de una pagina web, forzando al navegador a cachear la hoja de estilos incorrecta.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-01-06 CVE Reserved
2010-03-25 CVE Published
2023-03-07 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (8)

URL	Tag	Source
http://www.securityfocus.com/bid/38918	Vdb Entry
http://www.vupen.com/english/advisories/2010/0692	Vdb Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=535806	X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11391	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8431	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.mozilla.org/security/announce/2010/mfsa2010-14.html	2018-10-30
https://access.redhat.com/security/cve/CVE-2010-0169	2010-03-17
https://bugzilla.redhat.com/show_bug.cgi?id=576694	2010-03-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0 Search vendor "Mozilla" for product "Firefox" and version "3.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.1 Search vendor "Mozilla" for product "Firefox" and version "3.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.10 Search vendor "Mozilla" for product "Firefox" and version "3.0.10"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.11 Search vendor "Mozilla" for product "Firefox" and version "3.0.11"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.12 Search vendor "Mozilla" for product "Firefox" and version "3.0.12"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.13 Search vendor "Mozilla" for product "Firefox" and version "3.0.13"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.14 Search vendor "Mozilla" for product "Firefox" and version "3.0.14"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.15 Search vendor "Mozilla" for product "Firefox" and version "3.0.15"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.16 Search vendor "Mozilla" for product "Firefox" and version "3.0.16"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.0.17 Search vendor "Mozilla" for product "Firefox" and version "3.0.17"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5 Search vendor "Mozilla" for product "Firefox" and version "3.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.1 Search vendor "Mozilla" for product "Firefox" and version "3.5.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.2 Search vendor "Mozilla" for product "Firefox" and version "3.5.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.3 Search vendor "Mozilla" for product "Firefox" and version "3.5.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.4 Search vendor "Mozilla" for product "Firefox" and version "3.5.4"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.5 Search vendor "Mozilla" for product "Firefox" and version "3.5.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.6 Search vendor "Mozilla" for product "Firefox" and version "3.5.6"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.5.7 Search vendor "Mozilla" for product "Firefox" and version "3.5.7"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				3.6 Search vendor "Mozilla" for product "Firefox" and version "3.6"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				<= 2.0.2 Search vendor "Mozilla" for product "Seamonkey" and version " <= 2.0.2"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1 Search vendor "Mozilla" for product "Seamonkey" and version "1.1"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1 Search vendor "Mozilla" for product "Seamonkey" and version "1.1"		alpha		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1 Search vendor "Mozilla" for product "Seamonkey" and version "1.1"		beta		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.1 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.1"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.2 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.2"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.3 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.3"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.4 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.4"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.5 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.5"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.5 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.5"		1.1.10		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.6 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.6"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.7 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.7"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.8 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.8"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.9 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.9"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.10 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.10"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.11 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.11"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.12 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.12"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.13 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.13"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.14 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.14"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.15 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.15"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.16 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.16"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.17 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.17"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.18 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.18"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.1.19 Search vendor "Mozilla" for product "Seamonkey" and version "1.1.19"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		alpha_1		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		alpha_2		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		alpha_3		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		beta_1		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		beta_2		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		rc1		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0 Search vendor "Mozilla" for product "Seamonkey" and version "2.0"		rc2		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				2.0.1 Search vendor "Mozilla" for product "Seamonkey" and version "2.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				<= 3.0.1 Search vendor "Mozilla" for product "Thunderbird" and version " <= 3.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5 Search vendor "Mozilla" for product "Thunderbird" and version "1.5"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5 Search vendor "Mozilla" for product "Thunderbird" and version "1.5"		beta2		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.1 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.2 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.2"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.3 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.3"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.4 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.4"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.5 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.5"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.6 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.6"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.7 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.7"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.8 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.8"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.9 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.9"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.10 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.10"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.11 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.11"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.12 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.12"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.13 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.13"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.0.14 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.0.14"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.1 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.1"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				1.5.2 Search vendor "Mozilla" for product "Thunderbird" and version "1.5.2"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.0 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.0"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.3 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.3"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.4 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.4"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.5 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.5"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.6 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.6"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.7 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.7"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.8 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.8"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.9 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.9"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.12 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.12"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.14 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.14"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.16 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.16"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.17 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.17"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.18 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.18"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				2.0.0.19 Search vendor "Mozilla" for product "Thunderbird" and version "2.0.0.19"		-		Affected