Description
Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.12~pre080131b-0etch1 | DSA-1506-1 |
| Debian 4.0 | iceweasel | 2.0.0.10-0etch1 | DSA-1424-1 |
| Debian 4.0 | xulrunner | 1.8.0.14~pre071019c-0etch1 | DSA-1425-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox +1 | 1.5.0.12-7.el5 | RHSA-2007:1083, RHSA-2007:1082 |
| RHEL 4 | firefox | 1.5.0.12-0.8.el4 | RHSA-2007:1082 |
| RHEL 4 | seamonkey +5 | 1.0.9-7.el4 | RHSA-2007:1084 |
| RHEL 4 | thunderbird | 1.5.0.12-7.el4 | RHSA-2007:1083 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.7.el3 | RHSA-2007:1084 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.7.el2 | RHSA-2007:1084 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-7.el5 | RHSA-2007:1083 |
| RHEL 4.5 EUS | firefox | 1.5.0.12-0.8.el4 | RHSA-2007:1082 |
| RHEL 4.5 EUS | seamonkey +9 | 1.0.9-7.el4 | RHSA-2007:1084 |
Advisories 6
- RHSA-2007:1084 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1082 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1083 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1506-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1424-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1425-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 27816 third-party-advisory
- http://browser.netscape.com/releasenotes/
- 27855 third-party-advisory
- DSA-1424 vendor-advisory
- 26589 vdb-entry
- SUSE-SA:2007:066 vendor-advisory
- GLSA-200712-21 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
- https://issues.rpath.com/browse/RPL-1995
- 28277 third-party-advisory
- 27845 third-party-advisory
- RHSA-2007:1083 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
- oval:org.mitre.oval:def:9794 vdb-entry signature
- http://bugs.gentoo.org/show_bug.cgi?id=200909
- ADV-2008-0643 vdb-entry
- FEDORA-2007-3952 vendor-advisory
- RHSA-2007:1082 vendor-advisory
- SSA:2007-331-01 vendor-advisory
- 28016 third-party-advisory
- FEDORA-2007-4098 vendor-advisory
- HPSBUX02153 vendor-advisory
- MDKSA-2007:246 vendor-advisory
- USN-546-1 vendor-advisory
- ADV-2007-4018 vdb-entry
- 20080229 rPSA-2008-0093-1 thunderbird mailing-list
- 27838 third-party-advisory
- FEDORA-2007-4106 vendor-advisory
- 1018995 vdb-entry
- 20080212 FLEA-2008-0001-1 firefox mailing-list
- ADV-2007-4002 vdb-entry
- 1018977 vendor-advisory
- 27793 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=198965
- ADV-2008-0083 vdb-entry
- 27955 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0093
- USN-546-2 vendor-advisory
- FEDORA-2007-756 vendor-advisory
- 231441 vendor-advisory
- 27957 third-party-advisory
- 28398 third-party-advisory
- 29164 third-party-advisory
- mozilla-http-referer-spoofing(38644) vdb-entry
- 28001 third-party-advisory
- 27796 third-party-advisory
- SSA:2007-333-01 vendor-advisory
- https://issues.rpath.com/browse/RPL-1984
- 27797 third-party-advisory
- 27979 third-party-advisory
- 28171 third-party-advisory
- 27800 third-party-advisory
- RHSA-2007:1084 vendor-advisory
- DSA-1425 vendor-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
- 27944 third-party-advisory
- 27725 third-party-advisory