Closed
Bug 871536
Opened 13 years ago
Closed 13 years ago
(CVE-2012-1964) Mitigate clickjacking of about:certerror
Categories
(SeaMonkey :: Security, defect)
SeaMonkey
Security
Tracking
(seamonkey2.18 affected, seamonkey2.19 fixed, seamonkey2.20 fixed, seamonkey2.21 fixed)
RESOLVED
FIXED
seamonkey2.21
People
(Reporter: philip.chee, Assigned: philip.chee)
References
(
URL
)
Details
(Whiteboard: [sg:moderate])
Attachments
(1 file)
|
1.44 KB,
patch
|
neil
:
review+
Callek
:
approval-comm-aurora+
Callek
:
approval-comm-beta+
|
Details | Diff | Splinter Review |
From Bug 633691:
> This patch hides the ability to add the override if the certificate error
> occurs in a frame.
>
> Users can still right click on the page and use the context menu "This Frame ->
> Show Only This Frame" if they really need to override the certificate error.
> This also gives users a better chance to see that the domains are different.
|
Assignee | |
Comment 1•13 years ago
|
||
Straight port of Bug 633691
Test:
data:text/html,<iframe width="700" height="700" src="https://access.techsmith.com"></iframe>
|
|
Assignee | |
Updated•13 years ago
|
URL: data:text/html,<iframe width="700" he...
|
||
Comment 2•13 years ago
|
||
Comment on attachment 748803 [details] [diff] [review]
Proposed fix.
>+ // or if thecerterror is in a frame (bug 633691).
Nit: spaces around cert
Attachment #748803 -
Flags: review?(neil) → review+
|
|
Assignee | |
Comment 3•13 years ago
|
||
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
status-seamonkey2.18:
--- → affected
status-seamonkey2.19:
--- → affected
status-seamonkey2.20:
--- → affected
status-seamonkey2.21:
--- → fixed
Component: UI Design → Security
Resolution: --- → FIXED
Summary: Mitigate clickjacking of about:certerror → (CVE-2012-1964) Mitigate clickjacking of about:certerror
Target Milestone: --- → seamonkey2.21
|
|
Assignee | |
Comment 4•13 years ago
|
||
Comment on attachment 748803 [details] [diff] [review]
Proposed fix.
[Approval Request Comment]
Regression caused by (bug #): N/A
User impact if declined: Click-jacking attack vector on the about:certerror page.
Testing completed (on m-c, etc.): Fix Landed on Version: Firefox 11
Risk to taking this patch (and alternatives if risky): no risk anticipated
String or UUID changes made by this patch: none
Attachment #748803 -
Flags: approval-comm-beta?
Attachment #748803 -
Flags: approval-comm-aurora?
|
||
Updated•13 years ago
|
Attachment #748803 -
Flags: approval-comm-beta?
Attachment #748803 -
Flags: approval-comm-beta+
Attachment #748803 -
Flags: approval-comm-aurora?
Attachment #748803 -
Flags: approval-comm-aurora+
|
|
||
Comment 5•13 years ago
|
||
Dan, Al,
This was missed on our part from http://www.mozilla.org/security/announce/2012/mfsa2012-54.html :(
So we should update that mfsa for seamonkey.
Will be out in our 2.19 release (due out July 2)
Whiteboard: [sg:moderate]
|
|
Assignee | |
Comment 6•13 years ago
|
||
|
||
Comment 7•13 years ago
|
||
(In reply to Justin Wood (:Callek) from comment #5)
> Dan, Al,
>
> This was missed on our part from
> http://www.mozilla.org/security/announce/2012/mfsa2012-54.html :(
>
> So we should update that mfsa for seamonkey.
>
> Will be out in our 2.19 release (due out July 2)
So it didn't go out in SeaMonkey 2.10?
|
|
||
Comment 8•13 years ago
|
||
(In reply to Al Billings [:abillings] from comment #7)
> (In reply to Justin Wood (:Callek) from comment #5)
> > Dan, Al,
> >
> > This was missed on our part from
> > http://www.mozilla.org/security/announce/2012/mfsa2012-54.html :(
> >
> > So we should update that mfsa for seamonkey.
> >
> > Will be out in our 2.19 release (due out July 2)
>
> So it didn't go out in SeaMonkey 2.10?
Not as far as I can tell
You need to log in
before you can comment on or make changes to this bug.
Description
•