Description
Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch3+lenny1 | DTSA-52-1 |
| Debian 5.0 | icedove | 1.5.0.13+1.5.0.14b.dfsg1-0lenny1 | DTSA-71-1 |
| Debian 5.0 | iceweasel | 2.0.0.6-0etch1+lenny1 | DTSA-53-1 |
| Debian 5.0 | xulrunner | 1.8.0.13~pre070720-0etch3+lenny1 | DTSA-51-1 |
| Debian 4.0 | iceape | 1.0.10~pre070720-0etch3 | DSA-1346-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.14b.dfsg1-0etch1 | DSA-1391-1 |
| Debian 4.0 | iceweasel | 2.0.0.6-0etch1 | DSA-1344-1 |
| Debian 4.0 | xulrunner | 1.8.0.13~pre070720-0etch3 | DSA-1345-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-6.el5 | RHSA-2007:0979 |
| RHEL 5 | thunderbird | 1.5.0.12-5.el5 | RHSA-2007:0981 |
| RHEL 4 | firefox | 1.5.0.12-0.7.el4 | RHSA-2007:0979 |
| RHEL 4 | seamonkey +5 | 1.0.9-6.el4 | RHSA-2007:0980 |
| RHEL 4 | thunderbird | 1.5.0.12-0.5.el4 | RHSA-2007:0981 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.5.el3 | RHSA-2007:0980 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.6.el2 | RHSA-2007:0980 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Mozilla Firefox/Thunderbird/SeaMonkey - Chrome-Loaded About:Blank Script Execution EDB-30439 · remote · Jul 31, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 11
- RHSA-2007:0981 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0980 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0979 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-71-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-53-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-51-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1345-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1391-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-52-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1344-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1346-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2007-2601 vendor-advisory
- https://issues.rpath.com/browse/RPL-1600
- USN-503-1 vendor-advisory
- MDVSA-2008:047 vendor-advisory
- ADV-2007-3587 vdb-entry
- 27414 third-party-advisory
- HPSBUX02156 vendor-advisory
- http://bugzilla.mozilla.org/show_bug.cgi?id=388121
- 26393 third-party-advisory
- 26303 third-party-advisory
- ADV-2007-4256 vdb-entry
- 26309 third-party-advisory
- HPSBUX02153 vendor-advisory
- 27298 third-party-advisory
- MDKSA-2007:152 vendor-advisory
- GLSA-200708-09 vendor-advisory
- 1018481 vdb-entry
- DSA-1345 vendor-advisory
- 26288 third-party-advisory
- 27327 third-party-advisory
- 27276 third-party-advisory
- DSA-1391 vendor-advisory
- DSA-1346 vendor-advisory
- RHSA-2007:0980 vendor-advisory
- SUSE-SA:2007:057 vendor-advisory
- MDVSA-2007:047 vendor-advisory
- 28135 third-party-advisory
- 27356 third-party-advisory
- RHSA-2007:0981 vendor-advisory
- 25142 vdb-entry
- FEDORA-2007-3431 vendor-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-26.html
- ADV-2008-0082 vdb-entry
- 103177 vendor-advisory
- USN-493-1 vendor-advisory
- 26234 third-party-advisory
- DSA-1344 vendor-advisory
- 1018480 vdb-entry
- 27325 third-party-advisory
- RHSA-2007:0979 vendor-advisory
- 1018479 vdb-entry
- 26258 third-party-advisory
- 27326 third-party-advisory
- 28363 third-party-advisory
- 26331 third-party-advisory
- 26460 third-party-advisory
- 27680 third-party-advisory
- 20070801 FLEA-2007-0039-1 firefox mailing-list
- http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
- 201516 vendor-advisory
- oval:org.mitre.oval:def:9493 vdb-entry signature
- 20070803 FLEA-2007-0040-1 thunderbird mailing-list
- 26335 third-party-advisory
- 26572 third-party-advisory
- SSA:2007-213-01 vendor-advisory