PT-2007-5079 · Mozilla+1 · Firefox+3
Publicado
2007-08-08
·
Atualizado
2018-10-15
·
CVE-2007-3844
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
Mozilla Firefox versions 2.0.0.5 and earlier
Thunderbird versions 2.0.0.5 and earlier, and versions prior to 1.5.0.13
SeaMonkey version 1.1.3
Description:
The issue allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges. This is achieved via an addon that inserts a
javascript: or data: link into an about:blank document loaded by chrome. The document can be loaded using the window.open function or a content.location assignment.Recommendations:
For Mozilla Firefox versions 2.0.0.5 and earlier, update to a version that fixes the regression issue.
For Thunderbird versions 2.0.0.5 and earlier, and versions prior to 1.5.0.13, update to a version that fixes the regression issue.
For SeaMonkey version 1.1.3, update to a version that fixes the regression issue.
As a temporary workaround, consider disabling the use of addons that insert
javascript: or data: links into documents loaded by chrome until a patch is available.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Firefox
Red Hat
Seamonkey
Thunderbird