Description
browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI.
References (47)
Core 47
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=354973
Third Party Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0078.html
Patch, Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2007/mfsa2007-05.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24395
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/461336/100/0/threaded
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24328
Third Party Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0108.html
Third Party Advisory vendor-advisory
x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200703-04.xml
Third Party Advisory vendor-advisory
x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml
Third Party Advisory vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9884
Mailing List, Third Party Advisory vendor-advisory
x_refsource_slackware
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24384
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24457
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24343
Broken Link vendor-advisory
x_refsource_hp
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0718
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24650
Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-428-1
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24320
Broken Link x_refsource_confirm
https://issues.rpath.com/browse/RPL-1103
Broken Link vdb-entry
x_refsource_osvdb
http://www.osvdb.org/32107
Broken Link vendor-advisory
x_refsource_suse
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/461809/100/0/threaded
Broken Link vendor-advisory
x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_22_mozilla.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24293
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24238
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24393
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24342
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24287
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/22694
Broken Link vendor-advisory
x_refsource_fedora
http://fedoranews.org/cms/node/2713
Third Party Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0097.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1017702
Broken Link vendor-advisory
x_refsource_fedora
http://fedoranews.org/cms/node/2728
Broken Link vendor-advisory
x_refsource_sgi
ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/32667
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24205
Broken Link x_refsource_confirm
https://issues.rpath.com/browse/RPL-1081
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24333
Third Party Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24290
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24455
Third Party Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2007-0077.html
Broken Link vendor-advisory
x_refsource_sgi
ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc
Mailing List, Third Party Advisory vendor-advisory
x_refsource_slackware
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
Third Party Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0079.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24437
Scores
EPSS
0.0249
EPSS Percentile
82.9%
Details
CWE
CWE-79
Status
published
Products (5)
canonical/ubuntu_linux
5.10
canonical/ubuntu_linux
6.06
canonical/ubuntu_linux
6.10
mozilla/firefox
1.5 - 1.5.0.10
mozilla/seamonkey
< 1.0.8
Published
Feb 26, 2007
Tracked Since
Feb 18, 2026