CWE Code: 59
Vulnerability Type: privilege_escalation
CVSS Score: 5.1
CWE Name:  Improper Link Resolution Before File Access ('Link Following')
Summary: mozilla firefox before 3.0.6 and seamonkey do not block links to the (1) about:plugins and (2) about:config uris from .desktop files, which allows user-assisted remote attackers to bypass the same origin policy and execute arbitrary code with chrome privileges via vectors involving the url field in a desktop entry section of a .desktop file, related to representation of about: uris as jar:file:// uris.  note: this issue exists because of an incomplete fix for cve-2008-4582.
Access Authentication: NONE
Access Complexity: HIGH
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2009-02-04
Last Modified Date: 2017-09-29