Description
Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080323b-0etch1 | DSA-1534-2, DSA-1534-1 |
| Debian 4.0 | iceweasel | 2.0.0.13-0etch1 | DSA-1535-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080323b-0etch1 | DSA-1532-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-14.el5_1 | RHSA-2008:0207 |
| RHEL 5 | thunderbird | 1.5.0.12-11.el5_1 | RHSA-2008:0209 |
| RHEL 4 | firefox | 1.5.0.12-0.14.el4 | RHSA-2008:0207 |
| RHEL 4 | seamonkey +5 | 1.0.9-15.el4 | RHSA-2008:0208 |
| RHEL 4 | thunderbird | 1.5.0.12-10.el4 | RHSA-2008:0209 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.16.el3 | RHSA-2008:0208 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.14.el2 | RHSA-2008:0208 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-11.el5_1 | RHSA-2008:0209 |
Advisories 7
- RHSA-2008:0209 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0208 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0207 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1534-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1532-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1534-2 iceape - regression Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1535-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20080327 rPSA-2008-0128-1 firefox mailing-list
- 29541 third-party-advisory
- 29539 third-party-advisory
- 1019703 vdb-entry
- 30620 third-party-advisory
- 29560 third-party-advisory
- DSA-1532 vendor-advisory
- 30327 third-party-advisory
- 238492 vendor-advisory
- USN-592-1 vendor-advisory
- 29616 third-party-advisory
- 29550 third-party-advisory
- 29645 third-party-advisory
- 29607 third-party-advisory
- ADV-2008-1793 vdb-entry
- 29558 third-party-advisory
- oval:org.mitre.oval:def:9889 vdb-entry signature
- RHSA-2008:0208 vendor-advisory
- 29526 third-party-advisory
- SUSE-SA:2008:019 vendor-advisory
- TA08-087A third-party-advisory
- 29391 third-party-advisory
- RHSA-2008:0209 vendor-advisory
- 28448 vdb-entry
- RHSA-2008:0207 vendor-advisory
- mozilla-http-referrer-spoofing(41449) vdb-entry
- DSA-1534 vendor-advisory
- 29547 third-party-advisory
- http://sla.ckers.org/forum/read.php?10%2C20033
- GLSA-200805-18 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
- ADV-2008-0998 vdb-entry
- DSA-1535 vendor-advisory
- MDVSA-2008:080 vendor-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-16.html