Skip to content
OpenAdvisories
Unscored CVE-2005-1937 EUVD-2005-1939GHSA-ffxc-32xj-v3rp

A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the framese…

Published Jun 13, 2005 · Updated Aug 7, 2024 · Assigned by debian

Description

A regression error in Firefox 1.0.3 and Mozilla 1.7.7 allows remote attackers to inject arbitrary Javascript from one page into the frameset of another site, aka the frame injection spoofing vulnerability, a re-introduction of a vulnerability that was originally identified and addressed by CVE-2004-0718.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 4.0 mozilla 2:1.7.8-1sarge1 DTSA-14-1, DTSA-7-1
Debian 4.0 mozilla-firefox 1.0.4-2sarge3 DTSA-8-2
Debian 3.1 mozilla 2:1.7.8-1sarge1 DSA-810-1, DSA-777-1
Debian 3.1 mozilla-firefox 1.0.4-2sarge1 DSA-775-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 4 devhelp +1 0.9.2-2.4.6 RHSA-2005:587
RHEL 4 firefox 1.0.6-1.4.1 RHSA-2005:586

Advisories 8

References