Description
The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code via unknown vectors.
References (44)
Core 44
Core References
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32025
Vendor Advisory vendor-advisory
x_refsource_slackware
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2009/dsa-1697
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-645-1
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:206
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32144
Various Sources x_refsource_confirm
http://www.mozilla.org/security/announce/2008/mfsa2008-38.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32010
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0977
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-645-2
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/31346
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/31985
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/31984
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32185
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32196
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2008/dsa-1669
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32042
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45347
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9643
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33433
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=439034
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2661
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1020919
Vendor Advisory vendor-advisory
x_refsource_slackware
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422
Vendor Advisory vendor-advisory
x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32092
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:205
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2009/dsa-1696
Various Sources x_refsource_confirm
http://download.novell.com/Download?buildid=WZXONb-tqBw~
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-647-1
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32007
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0882.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32845
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2008/dsa-1649
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32012
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33434
Vendor Advisory vendor-advisory
x_refsource_slackware
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32044
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0908.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34501
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/32082
Scores
EPSS
0.0214
EPSS Percentile
80.0%
Details
CWE
CWE-264
Status
published
Products (47)
mozilla/firefox
0.8
mozilla/firefox
0.9 (2 CPE variants)
mozilla/firefox
0.9.1
mozilla/firefox
0.9.2
mozilla/firefox
0.9.3
mozilla/firefox
0.9_rc
mozilla/firefox
0.10
mozilla/firefox
0.10.1
mozilla/firefox
1.0
mozilla/firefox
1.0.1
... and 37 more
Published
Sep 24, 2008
Tracked Since
Feb 18, 2026