Description
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080323b-0etch1 | DSA-1534-1 |
Advisories 1
- DSA-1534-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=403331
- http://www.mozilla.org/security/announce/2007/mfsa2007-37.html
- HPSBUX02153 vendor-advisory
- http://blog.beford.org/?p=8
- ADV-2008-0083 vdb-entry
- 43477 vdb-entry
- oval:org.mitre.oval:def:6033 vdb-entry signature
- https://bugzilla.mozilla.org/show_bug.cgi?id=369814