Description
Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spawn windows without user interface components such as the address and status bar, which could be used to conduct spoofing or phishing attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.9.2-2.4.7 | RHSA-2005:789 |
| RHEL 4 | firefox +1 | 1.0.7-1.4.1 | RHSA-2005:791, RHSA-2005:785 |
Advisories 6
- RHSA-2005:791 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:789 Red Hat Security Advisory: mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:785 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-868-1 mozilla-thunderbird - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-838-1 mozilla-firefox - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-866-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2005:169 vendor-advisory
- DSA-868 vendor-advisory
- ADV-2005-1824 vdb-entry
- FLSA-2006:168375 vendor-advisory
- oval:org.mitre.oval:def:11130 vdb-entry signature
- mozilla-chrome-window-spoofing(22380) vdb-entry
- 19823 third-party-advisory
- 14919 vdb-entry
- 15495 vdb-entry
- 1014954 vdb-entry
- RHSA-2005:789 vendor-advisory
- 17026 third-party-advisory
- RHSA-2005:791 vendor-advisory
- 17042 third-party-advisory
- DSA-866 vendor-advisory
- 17284 third-party-advisory
- http://www.mozilla.org/security/announce/mfsa2005-59.html
- 17149 third-party-advisory
- 17263 third-party-advisory
- 16917 third-party-advisory
- DSA-838 vendor-advisory
- 17014 third-party-advisory
- oval:org.mitre.oval:def:1197 vdb-entry signature
- RHSA-2005:785 vendor-advisory
- SUSE-SA:2005:058 vendor-advisory
- SUSE-SA:2006:022 vendor-advisory
- MDKSA-2005:174 vendor-advisory
- 17090 third-party-advisory
- 16911 third-party-advisory
- 16977 third-party-advisory
- MDKSA-2005:170 vendor-advisory