Description
Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 can hide the window's titlebar when displaying XUL markup language documents, which makes it easier for remote attackers to conduct phishing and spoofing attacks by setting the hidechrome attribute.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.11~pre071022-0etch1+lenny1 | DTSA-80-1 |
| Debian 5.0 | xulrunner | 1.8.0.14~pre071019b-0lenny1 | DTSA-69-1 |
| Debian 4.0 | iceape | 1.0.11~pre071022-0etch1 | DSA-1401-1 |
| Debian 4.0 | iceweasel | 2.0.0.6+2.0.0.8-0etch1 | DSA-1396-1 |
| Debian 4.0 | xulrunner | 1.8.0.14~pre071019b-0etch1 | DSA-1392-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-6.el5 | RHSA-2007:0979 |
| RHEL 5 | thunderbird | 1.5.0.12-5.el5 | RHSA-2007:0981 |
| RHEL 4 | firefox | 1.5.0.12-0.7.el4 | RHSA-2007:0979 |
| RHEL 4 | seamonkey +5 | 1.0.9-6.el4 | RHSA-2007:0980 |
| RHEL 4 | thunderbird | 1.5.0.12-0.5.el4 | RHSA-2007:0981 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.5.el3 | RHSA-2007:0980 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.6.el2 | RHSA-2007:0980 |
Advisories 8
- RHSA-2007:0981 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0980 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0979 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-80-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-69-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1401-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1392-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1396-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2007-2601 vendor-advisory
- 20071026 rPSA-2007-0225-1 firefox mailing-list
- ADV-2007-3587 vdb-entry
- 27414 third-party-advisory
- 20071029 FLEA-2007-0062-1 firefox mailing-list
- https://issues.rpath.com/browse/RPL-1858
- GLSA-200711-14 vendor-advisory
- 27360 third-party-advisory
- HPSBUX02153 vendor-advisory
- 27298 third-party-advisory
- 27315 third-party-advisory
- 1018837 vdb-entry
- 27327 third-party-advisory
- ADV-2007-3544 vdb-entry
- 27276 third-party-advisory
- USN-535-1 vendor-advisory
- DSA-1401 vendor-advisory
- DSA-1392 vendor-advisory
- VU#349217 third-party-advisory
- RHSA-2007:0980 vendor-advisory
- 27383 third-party-advisory
- SUSE-SA:2007:057 vendor-advisory
- 27356 third-party-advisory
- RHSA-2007:0981 vendor-advisory
- ADV-2008-0083 vdb-entry
- 27387 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=391043
- FEDORA-2007-3431 vendor-advisory
- 27403 third-party-advisory
- 27336 third-party-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-33.html
- DSA-1396 vendor-advisory
- 27425 third-party-advisory
- 28398 third-party-advisory
- 27311 third-party-advisory
- 27325 third-party-advisory
- MDKSA-2007:202 vendor-advisory
- mozilla-xul-page-spoofing(37286) vdb-entry
- 27665 third-party-advisory
- RHSA-2007:0979 vendor-advisory
- 27335 third-party-advisory
- FEDORA-2007-2664 vendor-advisory
- 27480 third-party-advisory
- 27680 third-party-advisory
- 26132 vdb-entry
- http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
- 201516 vendor-advisory
- 20071029 rPSA-2007-0225-2 firefox thunderbird mailing-list
- USN-536-1 vendor-advisory
- oval:org.mitre.oval:def:11482 vdb-entry signature