Description
The Apple Java plugin, as used in Netscape 7.1 and 7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5, when tabbed browsing is enabled, does not properly handle SetWindow(NULL) calls, which allows Java applets from one tab to draw to other tabs and facilitates phishing attacks that spoof tabs.
References (7)
Core 7
Core References
Exploit mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/373309
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/12392
Exploit mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/373080
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/17137
Exploit mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/373232
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/11059
Exploit x_refsource_misc
http://bugzilla.mozilla.org/show_bug.cgi?id=162134
Scores
EPSS
0.0160
EPSS Percentile
73.1%
Details
Status
published
Products (4)
mozilla/firefox
0.9.3
mozilla/mozilla
1.7.2
netscape/navigator
7.1
netscape/navigator
7.2
Published
Dec 31, 2004
Tracked Since
Feb 18, 2026