Description
The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mozilla-firefox | 1.0.4-2sarge17 | DSA-1336-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-10.0.1.el5 | RHSA-2007:0097 |
| RHEL 5 | firefox | 1.5.0.10-2.el5 | RHSA-2007:0097 |
| RHEL 5 | thunderbird | 1.5.0.10-1.el5 | RHSA-2007:0108 |
| RHEL 5 | yelp | 2.16.0-14.0.1.el5 | RHSA-2007:0097 |
| RHEL 4 | devhelp +1 | 0.10-0.7.el4 | RHSA-2007:0077 |
| RHEL 4 | firefox +1 | 1.5.0.10-0.1.el4 | RHSA-2007:0079, RHSA-2007:0078 |
| RHEL 4 | seamonkey +5 | 1.0.8-0.2.el4 | RHSA-2007:0077 |
| RHEL 3 | seamonkey +9 | 1.0.8-0.2.el3 | RHSA-2007:0077 |
| RHEL 2 | seamonkey +9 | 1.0.8-0.2.el2 | RHSA-2007:0077 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 8
- RHSA-2007:0097 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0078 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0079 Red Hat Security Advisory: Firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0077 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1336-1 mozilla-firefox Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2007:0108 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2007:0078 vendor-advisory
- 24395 third-party-advisory
- oval:org.mitre.oval:def:10086 vdb-entry signature
- 20070226 rPSA-2007-0040-1 firefox mailing-list
- 24328 third-party-advisory
- RHSA-2007:0108 vendor-advisory
- SSA:2007-066-03 vendor-advisory
- 24384 third-party-advisory
- 24457 third-party-advisory
- 24343 third-party-advisory
- DSA-1336 vendor-advisory
- HPSBUX02153 vendor-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
- ADV-2007-0718 vdb-entry
- 24650 third-party-advisory
- USN-428-1 vendor-advisory
- 24320 third-party-advisory
- 25588 third-party-advisory
- https://issues.rpath.com/browse/RPL-1103
- SUSE-SA:2007:019 vendor-advisory
- SUSE-SA:2007:022 vendor-advisory
- 24342 third-party-advisory
- 24287 third-party-advisory
- 20070223 Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability mailing-list
- http://www.hardened-php.net/advisory_032007.142.html
- 22694 vdb-entry
- FEDORA-2007-281 vendor-advisory
- RHSA-2007:0097 vendor-advisory
- 1017702 vdb-entry
- FEDORA-2007-293 vendor-advisory
- 24205 third-party-advisory
- 24333 third-party-advisory
- 33812 vdb-entry
- MDKSA-2007:050 vendor-advisory
- 24290 third-party-advisory
- 24455 third-party-advisory
- RHSA-2007:0077 vendor-advisory
- SSA:2007-066-05 vendor-advisory
- RHSA-2007:0079 vendor-advisory