Description
Mozilla Firefox before 2.0.0.12 does not always display a web forgery warning dialog if the entire contents of a web page are in a DIV tag that uses absolute positioning, which makes it easier for remote attackers to conduct phishing attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.12~pre080131b-0etch1 | DSA-1506-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1-0etch2 | DSA-1485-2 |
| Debian 4.0 | iceweasel | 2.0.0.12-0etch1 | DSA-1489-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080131b-0etch1 | DSA-1484-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 6
- DSA-1489-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1506-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1484-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1485-2 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-576-1 vendor-advisory
- http://browser.netscape.com/releasenotes/
- 28939 third-party-advisory
- DSA-1506 vendor-advisory
- 30620 third-party-advisory
- 28865 third-party-advisory
- ADV-2008-0453 vdb-entry
- 28877 third-party-advisory
- 28879 third-party-advisory
- 29567 third-party-advisory
- 28958 third-party-advisory
- http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html
- 30327 third-party-advisory
- 238492 vendor-advisory
- DSA-1489 vendor-advisory
- 20080212 FLEA-2008-0001-1 firefox mailing-list
- 20080209 rPSA-2008-0051-1 firefox mailing-list
- 29086 third-party-advisory
- 28864 third-party-advisory
- DSA-1485 vendor-advisory
- 28924 third-party-advisory
- 27683 vdb-entry
- ADV-2008-1793 vdb-entry
- SUSE-SA:2008:008 vendor-advisory
- 1019342 vdb-entry
- http://www.mozilla.org/security/announce/2008/mfsa2008-11.html
- FEDORA-2008-1535 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0051
- DSA-1484 vendor-advisory
- ADV-2008-0627 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=408164
- GLSA-200805-18 vendor-advisory
- FEDORA-2008-1435 vendor-advisory
- MDVSA-2008:048 vendor-advisory