Description
Mozilla before 1.7.6, and Firefox before 1.0.1, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | firefox | 1.0.1-1.4.3 | RHSA-2005:176 |
Advisories 1
- RHSA-2005:176 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
- http://secunia.com/secunia_research/2004-13/advisory/
- 13129 third-party-advisory
- oval:org.mitre.oval:def:10117 vdb-entry signature
- RHSA-2005:176 vendor-advisory
- RHSA-2005:384 vendor-advisory
- GLSA-200503-30 vendor-advisory
- http://www.mozilla.org/security/announce/mfsa2005-13.html
- GLSA-200503-10 vendor-advisory
- oval:org.mitre.oval:def:100045 vdb-entry signature