Description
Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via (1) HTTP 302 redirect controls, (2) XMLHttpRequest, or (3) view-source URIs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 |
| Debian 5.0 | iceweasel | 2.0.0.5-0etch1+lenny1 | DTSA-45-1 |
| Debian 5.0 | xulrunner | 1.8.0.13~pre070720-0etch3+lenny1 | DTSA-51-1 |
| Debian 4.0 | iceape | 1.0.10~pre070720-0etch1 | DSA-1339-1 |
| Debian 4.0 | iceweasel | 2.0.0.5-0etch1 | DSA-1338-1 |
| Debian 4.0 | xulrunner | 1.8.0.13~pre070720-0etch1 | DSA-1337-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-3.el5 | RHSA-2007:0724 |
| RHEL 4 | firefox | 1.5.0.12-0.3.el4 | RHSA-2007:0724 |
| RHEL 4 | seamonkey +5 | 1.0.9-4.el4 | RHSA-2007:0722 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.3.el3 | RHSA-2007:0722 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.4.el2 | RHSA-2007:0722 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 91.1.1-1.1 | openSUSE-SU-2024:10601-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 11
- RHSA-2007:0724 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0722 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-51-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-47-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1339-1 iceape - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1338-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1337-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-45-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10601-1 MozillaThunderbird-91.1.1-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- USN-490-1 vendor-advisory
- 26107 third-party-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-24.html
- http://lcamtuf.coredump.cx/ffcache/
- 38028 vdb-entry
- 26179 third-party-advisory
- ADV-2007-4256 vdb-entry
- 25589 third-party-advisory
- 2872 third-party-advisory
- HPSBUX02153 vendor-advisory
- MDKSA-2007:152 vendor-advisory
- GLSA-200708-09 vendor-advisory
- 1018411 vdb-entry
- DSA-1339 vendor-advisory
- 25990 third-party-advisory
- 26151 third-party-advisory
- 28135 third-party-advisory
- 26216 third-party-advisory
- 26103 third-party-advisory
- 26072 third-party-advisory
- 26149 third-party-advisory
- oval:org.mitre.oval:def:9105 vdb-entry signature
- 103177 vendor-advisory
- DSA-1337 vendor-advisory
- 26211 third-party-advisory
- 26159 third-party-advisory
- SUSE-SA:2007:049 vendor-advisory
- DSA-1338 vendor-advisory
- http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html
- 20070709 Firefox wyciwyg:// cache zone bypass mailing-list
- https://bugzilla.mozilla.org/show_bug.cgi?id=387333
- 20070724 FLEA-2007-0033-1: firefox thunderbird mailing-list
- 26258 third-party-advisory
- 26460 third-party-advisory
- RHSA-2007:0724 vendor-advisory
- 20070720 rPSA-2007-0148-1 firefox thunderbird mailing-list
- 24831 vdb-entry
- 26271 third-party-advisory
- RHSA-2007:0722 vendor-advisory
- 201516 vendor-advisory
- mozilla-wyciwyg-security-bypass(35298) vdb-entry
- 26204 third-party-advisory
- 26205 third-party-advisory