Description
Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in a (1) OBJECT or (2) EMBED element, a related issue to CVE-2013-6674.
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1029773
Vendor Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2014/mfsa2014-14.html
Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=875818
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/863369
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1029774
Various Sources x_refsource_misc
http://www.vulnerability-lab.com/get_content.php?id=953
Scores
EPSS
0.0201
EPSS Percentile
78.6%
Details
CWE
CWE-79
Status
published
Products (39)
mozilla/seamonkey
mozilla/seamonkey
1.0 (3 CPE variants)
mozilla/seamonkey
1.0.1
mozilla/seamonkey
1.0.2
mozilla/seamonkey
1.0.3
mozilla/seamonkey
1.0.4
mozilla/seamonkey
1.0.5
mozilla/seamonkey
1.0.6
mozilla/seamonkey
1.0.7
mozilla/seamonkey
1.0.8
... and 29 more
Published
Feb 17, 2014
Tracked Since
Feb 18, 2026