Mozilla Firefox/Thunderbird/SeaMonkey CSP's Inline-Script Blocking Feature Security Bypass WeaknessUPDATED
26 Jul. 2012
Summary
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a security-bypass weakness that affects the Content Security Policy's (CSP) inline-script blocking security feature.
Vulnerable Systems:
*Mozilla Thunderbird ESR 10.0.4 and prior
An attacker can exploit this issue to bypass the inline-script blocking security feature of the affected applications. The attacker can perform cross-site scripting attacks on web applications that rely on this feature of CSP for protection.
Vendor Status:
Currently we are not aware of any vendor-supplied patches.
