Description
Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to spoof or hide the browser chrome, such as the location bar, by placing XUL popups outside of the browser's content pane. NOTE: this issue can be leveraged for phishing and other attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 |
| Debian 5.0 | iceweasel | 2.0.0.5-0etch1+lenny1 | DTSA-45-1 |
| Debian 5.0 | xulrunner | 1.8.0.13~pre070720-0etch3+lenny1 | DTSA-51-1 |
| Debian 4.0 | iceape | 1.0.9-0etch1 | DSA-1300-1 |
| Debian 4.0 | iceweasel | 2.0.0.4-0etch1 | DSA-1308-1 |
| Debian 4.0 | xulrunner | 1.8.0.12-0etch1 | DSA-1306-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-11.el5 | RHSA-2007:0400 |
| RHEL 5 | firefox +1 | 1.5.0.12-1.el5 | RHSA-2007:0401, RHSA-2007:0400 |
| RHEL 5 | yelp | 2.16.0-15.el5 | RHSA-2007:0400 |
| RHEL 4 | devhelp +1 | 0.10-0.8.el4 | RHSA-2007:0402 |
| RHEL 4 | firefox +1 | 1.5.0.12-0.1.el4 | RHSA-2007:0401, RHSA-2007:0400 |
| RHEL 4 | seamonkey +5 | 1.0.9-2.el4 | RHSA-2007:0402 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.1.el3 | RHSA-2007:0402 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.1.el2 | RHSA-2007:0402 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-1.el5 | RHSA-2007:0401 |
Advisories 9
- RHSA-2007:0400 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0402 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0401 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-51-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1300-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1306-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-47-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1308-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-45-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.mozilla.org/security/announce/2007/mfsa2007-17.html
- 1018155 vdb-entry
- oval:org.mitre.oval:def:11433 vdb-entry signature
- DSA-1308 vendor-advisory
- mozilla-xulpopups-spoofing(34606) vdb-entry
- MDKSA-2007:120 vendor-advisory
- 20070531 FLEA-2007-0023-1: firefox mailing-list
- 25647 third-party-advisory
- 25469 third-party-advisory
- HPSBUX02153 vendor-advisory
- SUSE-SA:2007:036 vendor-advisory
- 25491 third-party-advisory
- GLSA-200706-06 vendor-advisory
- 25635 third-party-advisory
- 25534 third-party-advisory
- ADV-2007-1994 vdb-entry
- RHSA-2007:0400 vendor-advisory
- SSA:2007-152-02 vendor-advisory
- 25533 third-party-advisory
- 1018156 vdb-entry
- DSA-1306 vendor-advisory
- https://issues.rpath.com/browse/RPL-1424
- 25858 third-party-advisory
- USN-468-1 vendor-advisory
- RHSA-2007:0401 vendor-advisory
- 35137 vdb-entry
- 25476 third-party-advisory
- MDKSA-2007:126 vendor-advisory
- 24242 vdb-entry
- 25750 third-party-advisory
- DSA-1300 vendor-advisory
- 25559 third-party-advisory
- 25490 third-party-advisory
- 25488 third-party-advisory
- RHSA-2007:0402 vendor-advisory
- TA07-151A third-party-advisory
- 25685 third-party-advisory