Description
Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.9.2-2.4.6 | RHSA-2005:587 |
| RHEL 4 | firefox +1 | 1.0.6-1.4.1 | RHSA-2005:601, RHSA-2005:586 |
Advisories 9
- RHSA-2005:601 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:587 Red Hat Security Advisory: mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:586 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-779-2 mozilla-firefox - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-810-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-781-1 mozilla-thunderbird - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-779-1 mozilla-firefox - several Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-8-2 mozilla-firefox - several vulnerabilities (update) Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-14-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-810 vendor-advisory
- SUSE-SR:2005:018 vendor-advisory
- P-252 third-party-advisory government-resource
- oval:org.mitre.oval:def:808 vdb-entry signature
- FLSA:160202 vendor-advisory
- 19823 third-party-advisory
- RHSA-2005:587 vendor-advisory
- 16059 third-party-advisory
- 16044 third-party-advisory
- ADV-2005-1075 vdb-entry
- RHSA-2005:601 vendor-advisory
- http://www.networksecurity.fi/advisories/netscape-multiple-issues.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=292591
- http://www.mozilla.org/security/announce/mfsa2005-46.html
- oval:org.mitre.oval:def:10947 vdb-entry signature
- SUSE-SA:2005:045 vendor-advisory
- oval:org.mitre.oval:def:1348 vdb-entry signature
- 14242 vdb-entry
- RHSA-2005:586 vendor-advisory
- 16043 third-party-advisory
- oval:org.mitre.oval:def:100012 vdb-entry signature
- SUSE-SA:2006:022 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=292589