Description
Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions of data from another domain via a JavaScript URL that redirects to the target resource, which generates an error if the target data does not have JavaScript syntax, which can be accessed using the window.onerror DOM API.
References (44)
Core 44
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/32882
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33408
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2009/dsa-1697
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/690-3/
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33205
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33421
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33232
Third Party Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-1036.html
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0977
Third Party Advisory vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9376
Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-690-2
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/499353/100/0/threaded
Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-701-1
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33231
Third Party Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:245
Third Party Advisory vendor-advisory
x_refsource_ubuntu
https://usn.ubuntu.com/690-1/
Third Party Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2009:012
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33203
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33433
Third Party Advisory x_refsource_misc
http://scary.beasts.org/security/CESA-2008-011.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2009/dsa-1707
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33216
Broken Link vendor-advisory
x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1021423
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2008/mfsa2008-65.html
Third Party Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-1037.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2009/dsa-1704
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2009/dsa-1696
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33204
Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-701-2
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33184
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47413
Third Party Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-0002.html
Broken Link vendor-advisory
x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1
Third Party Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:244
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33415
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33188
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33523
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/35080
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=461735
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33547
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33434
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33189
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/34501
Scores
EPSS
0.0166
EPSS Percentile
73.9%
Details
CWE
CWE-200
Status
published
Products (9)
canonical/ubuntu_linux
6.06
canonical/ubuntu_linux
7.10
canonical/ubuntu_linux
8.04
canonical/ubuntu_linux
8.10
debian/debian_linux
4.0
debian/debian_linux
5.0
mozilla/firefox
2.0 - 2.0.0.19
mozilla/seamonkey
1.0 - 1.1.14
mozilla/thunderbird
2.0 - 2.0.0.19
Published
Dec 17, 2008
Tracked Since
Feb 18, 2026