Description
The nsExternalAppHandler::SetUpTempFile function in Mozilla Firefox 1.5.0.9 creates temporary files with predictable filenames based on creation time, which allows remote attackers to execute arbitrary web script or HTML via a crafted XMLHttpRequest.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 45.0esr-1 | — |
| Debian 13 | firefox-esr | 45.0esr-1 | — |
| Debian 12 | firefox-esr | 45.0esr-1 | — |
References
- GLSA-200703-04 vendor-advisory
- 22396 vdb-entry
- GLSA-200703-08 vendor-advisory
- 24393 third-party-advisory
- 32108 vdb-entry
- 20070205 Re: [Full-disclosure] Firefox + popup blocker + XMLHttpRequest + srand() = oops mailing-list
- 20070205 Firefox + popup blocker + XMLHttpRequest + srand() = oops mailing-list
- 24437 third-party-advisory