Mozilla Firefox/Thunderbird/SeaMonkey CSP's Inline-Script Blocking Feature Security Bypass Weakness
10 Apr. 2012
Summary
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a security-bypass weakness that affects the Content Security Policy's (CSP) inline-script blocking security feature.
Vulnerable Systems:
* Mozilla Thunderbird ESR 10.0.4 and prior
An attacker can exploit this issue to bypass the inline-script blocking security feature of the affected applications. The attacker can perform cross-site scripting attacks on web applications that rely on this feature of CSP for protection.
Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials by conducting cross-site scripting attacks.
Vendor Status:
Vendor as issued an update for this vulnerablity.
