Description
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 allow remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via vectors involving (1) an event handler attached to an outer window, (2) a SCRIPT element in an unloaded document, or (3) the onreadystatechange handler in conjunction with an XMLHttpRequest.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080614i-0etch1 | DSA-1697-1 |
| Debian 4.0 | iceweasel | 2.0.0.15-0etch1 | DSA-1607-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080614d-0etch1 | DSA-1615-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-17.el5 | RHSA-2008:0569 |
| RHEL 5 | firefox | 3.0-2.el5 | RHSA-2008:0569 |
| RHEL 5 | thunderbird | 2.0.0.16-1.el5 | RHSA-2008:0616 |
| RHEL 5 | xulrunner +2 | 1.9-1.el5 | RHSA-2008:0569 |
| RHEL 5 | yelp | 2.16.0-19.el5 | RHSA-2008:0569 |
| RHEL 4 | firefox | 1.5.0.12-0.19.el4 | RHSA-2008:0549 |
| RHEL 4 | seamonkey +5 | 1.0.9-16.3.el4_6 | RHSA-2008:0547 |
| RHEL 4 | thunderbird | 1.5.0.12-14.el4 | RHSA-2008:0616 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.20.el3 | RHSA-2008:0547 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.17.el2 | RHSA-2008:0547 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 2.0.0.16-1.el5 | RHSA-2008:0616 |
Advisories 7
- RHSA-2008:0569 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0616 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0549 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0547 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1697-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1607-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1615-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2008:034 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=433328
- RHSA-2008:0549 vendor-advisory
- DSA-1697 vendor-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-22.html
- 31021 third-party-advisory
- oval:org.mitre.oval:def:9386 vdb-entry signature
- 30898 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0216
- https://issues.rpath.com/browse/RPL-2646
- 30949 third-party-advisory
- SSA:2008-191-03 vendor-advisory
- ADV-2009-0977 vdb-entry
- 31069 third-party-advisory
- 31008 third-party-advisory
- 31377 third-party-advisory
- RHSA-2008:0616 vendor-advisory
- ADV-2008-1993 vdb-entry
- 31023 third-party-advisory
- 30038 vdb-entry
- DSA-1607 vendor-advisory
- GLSA-200808-03 vendor-advisory
- 31005 third-party-advisory
- 33433 third-party-advisory
- FEDORA-2008-6127 vendor-advisory
- 1020419 vdb-entry
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15
- 31183 third-party-advisory
- 30903 third-party-advisory
- RHSA-2008:0547 vendor-advisory
- FEDORA-2008-6193 vendor-advisory
- 256408 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=439035
- SSA:2008-191 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=428672
- DSA-1615 vendor-advisory
- 31195 third-party-advisory
- 31076 third-party-advisory
- USN-619-1 vendor-advisory
- 30911 third-party-advisory
- RHSA-2008:0569 vendor-advisory
- 30878 third-party-advisory
- 20080708 rPSA-2008-0216-1 firefox mailing-list
- FEDORA-2008-6196 vendor-advisory
- 34501 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=432591
- https://bugzilla.mozilla.org/show_bug.cgi?id=440308
- MDVSA-2008:136 vendor-advisory