Description
The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Advisories 6
- DSA-810-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-777-1 mozilla - frame injection spoofing Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-775-1 mozilla-firefox - frame injection spoofing Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-8-2 mozilla-firefox - several vulnerabilities (update) Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-14-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-7-1 mozilla - frame injection spoofing Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-810 vendor-advisory
- DSA-777 vendor-advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/1598 vdb-entry
- SUSE-SA:2004:036 vendor-advisory
- RHSA-2004:421 vendor-advisory
- MDKSA-2004:082 vendor-advisory
- FLSA:2089 vendor-advisory
- 15495 vdb-entry
- 11978 third-party-advisory
- oval:org.mitre.oval:def:4756 vdb-entry signature
- http://bugzilla.mozilla.org/show_bug.cgi?id=246448
- http://secunia.com/multiple_browsers_frame_injection_vulnerability_test/
- oval:org.mitre.oval:def:9997 vdb-entry signature