Skip to content
OpenAdvisories
Unscored CVE-2005-2266 EUVD-2005-2267GHSA-gp89-32gv-6hww

Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the par…

Published Jul 13, 2005 · Updated Aug 7, 2024 · Assigned by redhat

Description

Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 4.0 mozilla 2:1.7.8-1sarge2 DTSA-14-1
Debian 4.0 mozilla-firefox 1.0.4-2sarge3 DTSA-8-2
Debian 3.1 mozilla 2:1.7.8-1sarge2 DSA-810-1
Debian 3.1 mozilla-firefox 1.0.4-2sarge2 DSA-779-2, DSA-779-1
Debian 3.1 mozilla-thunderbird 1.0.2-2.sarge1.0.6 DSA-781-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 4 devhelp +1 0.9.2-2.4.6 RHSA-2005:587
RHEL 4 firefox +1 1.0.6-1.4.1 RHSA-2005:601, RHSA-2005:586

Advisories 9

References