|
|
>> Wizz RSS News Reader Feed Handling Remote Chrome Code Execution Vulnerability
|
Title : Wizz RSS News Reader Feed Handling Remote Chrome Code Execution Vulnerability
VUPEN ID : VUPEN/ADV-2007-1425
CVE ID : CVE-2007-2060
Rated as : High Risk 
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2007-04-17
|
A vulnerability has been identified in Wizz RSS News Reader (extension for Firefox), which could be exploited by remote attackers to take complete control of an affected system. This issue is caused by an input validation error when processing RSS feeds, which could be exploited by attackers to execute arbitrary code with chrome privileges by convincing a user to visit a specially crafted web page.
Affected Products
Wizz RSS News Reader versions 2.x
Solution
Upgrade to version 2.1.9 :
https://addons.mozilla.org/en-US/firefox/addon/424
References
http://www.vupen.com/english/advisories/2007/1425
https://addons.mozilla.org/en-US/firefox/addon/424
Credits
Vulnerability reported by Jefferson Ogata (NOAA Computer Incident Response Team)
ChangeLog
2007-04-17 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
