Secure testing team - Dec 2009 - Bug#559267: CVE-2009-4102: RSS Feeds Cross Domain Scripting Vulnerability

Package: firefox-sage
Severity: grave
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for firefox-sage.

CVE-2009-4102[0]:
| Sage 1.4.3 and earlier extension for Firefox performs certain
| operations with chrome privileges, which allows remote attackers to
| execute arbitrary commands and perform cross-domain scripting attacks
| via the description tag of an RSS feed.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4102
    http://security-tracker.debian.org/tracker/CVE-2009-4102

Cheers,
Giuseppe

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAksXdqQACgkQNxpp46476aqbDQCeNuf5jhtHYPRDov2Sl4jNMQo6
hy4Ani1N8/crIsZ69wOGMPKgEA3evIWI
=LgV6
-----END PGP SIGNATURE-----