PublicDateAtUSN: 2010-09-07
Candidate: CVE-2010-2763
PublicDate: 2010-09-09 19:00:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2763
 https://ubuntu.com/security/notices/USN-978-1
Description:
 The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW)
 implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7,
 and SeaMonkey before 2.0.7 does not properly restrict scripted functions,
 which allows remote attackers to bypass the Same Origin Policy and conduct
 cross-site scripting (XSS) attacks via a crafted function.
Ubuntu-Description: 
Notes: 
 jdstrand> CVEs in Firefox are tracked in the xulrunner source packages for
  builds that use the system xulrunner, and firefox source packages for those
  that use a static build
   xulrunner (1.8.0): firefox (1.5) - Ubuntu 6.06 LTS (system xul)
   xulrunner (1.8.1): firefox (2.0) - Ubuntu 6.10 - 8.04 LTS (system xul)
   xulrunner-1.9: (ignored) reverse dependencies no longer process web content
   xulrunner-1.9.1: (ignored) reverese dependencies no longer process web content
   xulrunner-1.9.2: system xul for reverese dependencies that process web content
   firefox: Ubuntu 6.06 LTS (static build)
   firefox: Ubuntu 10.04 LTS and higher (static build of 3.6.x or higher)
   firefox-3.0: Ubuntu 8.04 LTS, 9.04 (static build of 3.6.x)
   firefox-3.5: Ubuntu 9.04 (ignored, uses system xul 1.9.1. Use 3.0 instead)
   firefox-3.5: Ubuntu 9.10 (static build of 3.6.x)
Bugs: 
Priority: medium
Discovered-by:
Assigned-to: chriscoulson
CVSS: 

Patches_firefox-3.5:
upstream_firefox-3.5: needs-triage (Ubuntu source uses 3.6.x)
dapper_firefox-3.5: DNE
hardy_firefox-3.5: DNE
jaunty_firefox-3.5: released (3.5.12+build1+nobinonly-0ubuntu0.9.04.1)
karmic_firefox-3.5: not-affected
lucid_firefox-3.5: DNE
devel_firefox-3.5: DNE

Patches_seamonkey:
upstream_seamonkey: released (2.0.7)
dapper_seamonkey: DNE
hardy_seamonkey: released (2.0.8+build1+nobinonly-0ubuntu0.8.04.1)
jaunty_seamonkey: released (2.0.8+build1+nobinonly-0ubuntu0.9.04.1)
karmic_seamonkey: released (2.0.8+build1+nobinonly-0ubuntu0.9.10.1)
lucid_seamonkey: released (2.0.7+build1+nobinonly-0ubuntu0.10.04.1)
devel_seamonkey: released (2.0.7+build1+nobinonly-0ubuntu1)


Patches_thunderbird:
Priority_thunderbird: low
upstream_thunderbird: released (3.0.7, 3.1.3)
dapper_thunderbird: DNE
hardy_thunderbird: ignored (requires javascript)
jaunty_thunderbird: ignored (requires javascript)
karmic_thunderbird: ignored (requires javascript)
lucid_thunderbird: released (3.0.7+build1+nobinonly-0ubuntu0.10.04.1)
devel_thunderbird: not-affected