The host is installed with Mozilla Firefox or Thunderbird and is prone to information disclosure vulnerability.

Successful exploitation will allow remote attackers to obtain potentially sensitive information. Impact Level: Application

Upgrade to Firefox version 5.0 or later. http://www.mozilla.com/en-US/firefox/all.html Upgrade to Thunderbird version 5.0 or later http://www.mozillamessaging.com/en-US/thunderbird/

The flaw is due to an error in WebGL, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader.

Thunderbird versions before 5.0 Mozilla Firefox versions before 5.0

• http://www.contextis.co.uk/resources/blog/webgl/
• https://bugzilla.mozilla.org/show_bug.cgi?id=656277
• https://developer.mozilla.org/en/WebGL/Cross-Domain_Textures
• https://hacks.mozilla.org/2011/06/cross-domain-webgl-textures-disabled-in-firefox-5/

---

Updated on 2015-03-25