Description
The popup blocker in Mozilla Firefox before 1.5.0.7 opens the "blocked popups" display in the context of the Location bar instead of the subframe from which the popup originated, which might make it easier for remote user-assisted attackers to conduct cross-site scripting (XSS) attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1.5.0.7-1 | — |
| Debian 13 | thunderbird | 1.5.0.7-1 | — |
| Debian 12 | thunderbird | 1.5.0.7-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | firefox | 1.5.0.7-0.1.el4 | RHSA-2006:0675 |
Advisories 1
- RHSA-2006:0675 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- ADV-2006-3748 vdb-entry
- oval:org.mitre.oval:def:10650 vdb-entry signature
- 22195 third-party-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-62.html
- 1016849 vdb-entry
- 21950 third-party-advisory
- USN-351-1 vendor-advisory
- 22025 third-party-advisory
- 22056 third-party-advisory
- MDKSA-2006:168 vendor-advisory
- 22210 third-party-advisory
- 24711 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-224.htm
- ADV-2008-0083 vdb-entry
- firefox-popup-blocker-xss(28957) vdb-entry
- ADV-2007-1198 vdb-entry
- GLSA-200609-19 vendor-advisory
- SSRT061181 vendor-advisory
- RHSA-2006:0675 vendor-advisory
- 20042 vdb-entry
- 22001 third-party-advisory
- 20060915 rPSA-2006-0169-1 firefox thunderbird mailing-list
- 22066 third-party-advisory
- 21949 third-party-advisory
- SUSE-SA:2006:054 vendor-advisory
- https://issues.rpath.com/browse/RPL-640
- USN-354-1 vendor-advisory
- 22422 third-party-advisory