Skip to content
OpenAdvisories
Unscored CVE-2005-2263 EUVD-2005-2264GHSA-5v66-4mqr-49xj

The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function i…

Published Jul 13, 2005 · Updated Aug 7, 2024 · Assigned by redhat

Description

The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 4.0 mozilla 2:1.7.8-1sarge2 DTSA-14-1
Debian 4.0 mozilla-firefox 1.0.4-2sarge3 DTSA-8-2
Debian 3.1 mozilla 2:1.7.8-1sarge2 DSA-810-1
Debian 3.1 mozilla-firefox 1.0.4-2sarge2 DSA-779-2, DSA-779-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 4 devhelp +1 0.9.2-2.4.6 RHSA-2005:587
RHEL 4 firefox 1.0.6-1.4.1 RHSA-2005:586

Advisories 7

References