Mozilla Firefox Direct2D API achieves same-origin Policy Bypass Vulnerability

Release date:
Last Updated:
Hazard level:
Vulnerability Type: Design Error
Threat Type: Remote

Vulnerability introduction:

Direct2D is a real-time, hardware-accelerated two-dimensional graphics API that provides high-performance and high-quality rendering for 2D geometric images, bitmaps, and text. Mozilla Firefox is a free, open-source browser applicable to Windows, Linux, and MacOS X platforms.

This vulnerability exists when Direct2D (also known as D2D) API is used in Windows. The functional implementations of Mozilla Firefox 4.x to 5.are vulnerable. Remote attackers can insert data into the canvas to bypass the same-origin policy to obtain sensitive image data from different domains.

Vulnerability announcement:

Currently, the vendor has released an upgrade patch to fix this security issue. Obtain the patch link:
Https://developer.mozilla.org/en/Download_Mozilla_Source_Code

Reference URL:

Source: bugzilla.w.illa.org
Link: https://bugzilla.mozilla.org/show_bug.cgi? Id = 655836

Source: www.mozilla.org
Link: http://www.mozilla.org/security/announce/2011/mfsa2011-29.html

Source: SECUNIA
Name: 45581
Link: http://secunia.com/advisories/45581