PT-2004-2120 · Mozilla+1 · Firefox+2

Published 2004-12-10 · Updated 2017-10-11 · CVE-2004-1156

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Mozilla versions prior to 1.7.6 Firefox versions prior to 1.0.1

Description: The issue allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain. This can be demonstrated using a pop-up window on a trusted web site.

Recommendations: For Mozilla versions prior to 1.7.6, update to version 1.7.6 or later. For Firefox versions prior to 1.0.1, update to version 1.0.1 or later.

Fix

Related Identifiers

CVE-2004-1156

RHSA-2005:176

RHSA-2005_176

RHSA-2005_384

Affected Products

Firefox

Mozilla Firefox

Red Hat

References · 61

• http://gentoo.org/security/en/glsa/glsa-200503-10.xml · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200503-30.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-176.html · Vendor Advisory
• http://secunia.com/secunia_research/2004-13/advisory · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-384.html · Vendor Advisory
• http://secunia.com/advisories/13129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1156 · Security Note
• https://redhat.com/security/data/cve/CVE-2005-0590.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0989.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0233.html · Note
• http://shmoo.com/idn/homograph.txt · Note
• https://redhat.com/security/data/cve/CVE-2005-0588.html · Note
• http://secunia.com/multiple_browsers_window_injection_vulnerability_test · Note
• http://mikx.de/firespoofing · Note
• http://securitytracker.com/id?1013635 · Note