Description
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 |
| Debian 5.0 | iceweasel | 2.0.0.5-0etch1+lenny1 | DTSA-45-1 |
| Debian 5.0 | xulrunner | 1.8.0.13~pre070720-0etch3+lenny1 | DTSA-51-1 |
| Debian 4.0 | iceape | 1.0.10~pre070720-0etch1 | DSA-1339-1 |
| Debian 4.0 | iceweasel | 2.0.0.5-0etch1 | DSA-1338-1 |
| Debian 4.0 | xulrunner | 1.8.0.13~pre070720-0etch1 | DSA-1337-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox +1 | 1.5.0.12-3.el5 | RHSA-2007:0724, RHSA-2007:0723 |
| RHEL 4 | firefox +1 | 1.5.0.12-0.3.el4 | RHSA-2007:0724, RHSA-2007:0723 |
| RHEL 4 | seamonkey +5 | 1.0.9-4.el4 | RHSA-2007:0722 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.3.el3 | RHSA-2007:0722 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.4.el2 | RHSA-2007:0722 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 91.1.1-1.1 | openSUSE-SU-2024:10601-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 12
- RHSA-2007:0724 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0723 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0722 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-51-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-47-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1339-1 iceape - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1338-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1337-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-45-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10601-1 MozillaThunderbird-91.1.1-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- USN-490-1 vendor-advisory
- 26107 third-party-advisory
- oval:org.mitre.oval:def:11749 vdb-entry signature
- 26179 third-party-advisory
- ADV-2007-4256 vdb-entry
- 25589 third-party-advisory
- 1018410 vdb-entry
- HPSBUX02153 vendor-advisory
- MDKSA-2007:152 vendor-advisory
- GLSA-200708-09 vendor-advisory
- DSA-1339 vendor-advisory
- 26151 third-party-advisory
- 28135 third-party-advisory
- 26216 third-party-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-19.html
- 26103 third-party-advisory
- 26072 third-party-advisory
- 26149 third-party-advisory
- 103177 vendor-advisory
- ADV-2007-2564 vdb-entry
- DSA-1337 vendor-advisory
- 26211 third-party-advisory
- 26159 third-party-advisory
- SUSE-SA:2007:049 vendor-advisory
- DSA-1338 vendor-advisory
- http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html
- 26095 third-party-advisory
- 20070724 FLEA-2007-0033-1: firefox thunderbird mailing-list
- 26258 third-party-advisory
- 24946 vdb-entry
- 26460 third-party-advisory
- 26106 third-party-advisory
- RHSA-2007:0724 vendor-advisory
- 20070720 rPSA-2007-0148-1 firefox thunderbird mailing-list
- RHSA-2007:0723 vendor-advisory
- mozilla-addeventlistener-settimeout-xss(35462) vdb-entry
- 26271 third-party-advisory
- RHSA-2007:0722 vendor-advisory
- 201516 vendor-advisory
- 26204 third-party-advisory
- 26205 third-party-advisory