Description
Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code that intercepts keystroke values from window.event, aka the "promiscuous IFRAME access bug," a related issue to CVE-2006-4568.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 |
| Debian 5.0 | iceweasel | 2.0.0.5-0etch1+lenny1 | DTSA-45-1 |
| Debian 5.0 | xulrunner | 1.8.0.13~pre070720-0etch3+lenny1 | DTSA-51-1 |
| Debian 4.0 | iceape | 1.0.10~pre070720-0etch1 | DSA-1339-1 |
| Debian 4.0 | iceweasel | 2.0.0.5-0etch1 | DSA-1338-1 |
| Debian 4.0 | xulrunner | 1.8.0.13~pre070720-0etch1 | DSA-1337-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox +1 | 1.5.0.12-3.el5 | RHSA-2007:0724, RHSA-2007:0723 |
| RHEL 4 | firefox +1 | 1.5.0.12-0.3.el4 | RHSA-2007:0724, RHSA-2007:0723 |
| RHEL 4 | seamonkey +5 | 1.0.9-4.el4 | RHSA-2007:0722 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.3.el3 | RHSA-2007:0722 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.4.el2 | RHSA-2007:0722 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 91.1.1-1.1 | openSUSE-SU-2024:10601-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 12
- RHSA-2007:0724 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0723 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0722 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-51-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-47-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1339-1 iceape - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1338-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1337-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-45-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10601-1 MozillaThunderbird-91.1.1-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- USN-490-1 vendor-advisory
- 1018412 vdb-entry
- 26107 third-party-advisory
- VU#143297 third-party-advisory
- 26179 third-party-advisory
- ADV-2007-4256 vdb-entry
- 25589 third-party-advisory
- http://lcamtuf.coredump.cx/ifsnatch/
- HPSBUX02153 vendor-advisory
- MDKSA-2007:152 vendor-advisory
- GLSA-200708-09 vendor-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-20.html
- DSA-1339 vendor-advisory
- oval:org.mitre.oval:def:11122 vdb-entry signature
- TA07-199A third-party-advisory
- 26151 third-party-advisory
- 20070604 Assorted browser vulnerabilities mailing-list
- firefox-iframe-security-bypass(34701) vdb-entry
- 28135 third-party-advisory
- 20070604 Assorted browser vulnerabilities mailing-list
- 26216 third-party-advisory
- 26103 third-party-advisory
- 24286 vdb-entry
- 26072 third-party-advisory
- 26149 third-party-advisory
- 103177 vendor-advisory
- ADV-2007-2564 vdb-entry
- DSA-1337 vendor-advisory
- 26211 third-party-advisory
- 2781 third-party-advisory
- 26159 third-party-advisory
- SUSE-SA:2007:049 vendor-advisory
- DSA-1338 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=381300
- http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html
- 26095 third-party-advisory
- 20070724 FLEA-2007-0033-1: firefox thunderbird mailing-list
- 26258 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=382686
- 26460 third-party-advisory
- 26106 third-party-advisory
- RHSA-2007:0724 vendor-advisory
- 20070720 rPSA-2007-0148-1 firefox thunderbird mailing-list
- RHSA-2007:0723 vendor-advisory
- 26271 third-party-advisory
- 38024 vdb-entry
- RHSA-2007:0722 vendor-advisory
- 201516 vendor-advisory
- 26204 third-party-advisory
- 26205 third-party-advisory