Description
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.
References
- oval:org.mitre.oval:def:4403 vdb-entry signature
- SUSE-SA:2004:036 vendor-advisory
- RHSA-2004:421 vendor-advisory
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7
- FLSA:2089 vendor-advisory
- mozilla-dialog-code-execution(16623) vdb-entry
- 15495 vdb-entry
- http://bugzilla.mozilla.org/show_bug.cgi?id=162020
- oval:org.mitre.oval:def:10032 vdb-entry signature
- 11999 third-party-advisory
- http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/
- 20040407 Race conditions in security dialogs mailing-list