Уязвимость чтения произвольных файлов в Mozilla Firefox, Mozilla Suite и SeaMonkey
Описание
Уязвимость в Mozilla Firefox версий до 1.5.0.2 и 1.0.x до 1.0.8, Mozilla Suite до версии 1.7.13, и SeaMonkey до версии 1.0.1 позволяет злоумышленникам удалённо читать произвольные файлы. Это возможно за счёт:
- вставки имени целевого файла в текстовое поле с последующим преобразованием этого поля в элемент управления загрузкой файлов
- изменения типа элемента ввода, связанного с обработчиком событий.
Затронутые версии ПО
- Mozilla Firefox 1.x до 1.5.0.2 и 1.0.x до 1.0.8
- Mozilla Suite до 1.7.13
- SeaMonkey до 1.0.1
Тип уязвимости
- Удалённое чтение произвольных файлов
Ссылки
- Broken Link
- Broken Link
- Broken Link
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler.
Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler.
Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Sui ...
Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler.
EPSS
4.3 Medium
CVSS2