CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 7.5
CWE Name:  Permissions Privileges and Access Controls
Summary: the xpconnect component in mozilla firefox before 2.0.0.17 and 3.x before 3.0.2, thunderbird before 2.0.0.17, and seamonkey before 1.1.12 allows remote attackers to "pollute xpcnativewrappers" and execute arbitrary code with chrome privileges via vectors related to (1) chrome xbl and (2) chrome js. note: thunderbird shares the browser engine with firefox and could be vulnerable if javascript were to be enabled in mail. this is not the default setting and we strongly discourage users from running javascript in mail.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2008-09-24
Last Modified Date: 2018-11-01