Description
The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080614i-0etch1 | DSA-1697-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1 | DSA-1696-1 |
| Debian 4.0 | iceweasel | 2.0.0.17-0etch1 | DSA-1649-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080614h-0etch1 | DSA-1669-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | thunderbird | 2.0.0.17-1.el5 | RHSA-2008:0908 |
| RHEL 4 | devhelp +1 | 0.10-0.10.el4 | RHSA-2008:0882 |
| RHEL 4 | seamonkey +5 | 1.0.9-26.el4 | RHSA-2008:0882 |
| RHEL 4 | thunderbird | 1.5.0.12-16.el4 | RHSA-2008:0908 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.24.el3 | RHSA-2008:0882 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.20.el2 | RHSA-2008:0882 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 2.0.0.17-1.el5 | RHSA-2008:0908 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 91.1.1-1.1 | openSUSE-SU-2024:10601-1 |
Advisories 7
- RHSA-2008:0908 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0882 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1697-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1649-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1669-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1696-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10601-1 MozillaThunderbird-91.1.1-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 32025 third-party-advisory
- SSA:2008-269-01 vendor-advisory
- DSA-1697 vendor-advisory
- FEDORA-2008-8401 vendor-advisory
- USN-645-1 vendor-advisory
- MDVSA-2008:206 vendor-advisory
- 32144 third-party-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-38.html
- 32010 third-party-advisory
- ADV-2009-0977 vdb-entry
- USN-645-2 vendor-advisory
- 31346 vdb-entry
- 31985 third-party-advisory
- SUSE-SA:2008:050 vendor-advisory
- 31984 third-party-advisory
- 32185 third-party-advisory
- 32196 third-party-advisory
- DSA-1669 vendor-advisory
- 32042 third-party-advisory
- firefox-onchannelredirect-security-bypass(45347) vdb-entry
- oval:org.mitre.oval:def:9643 vdb-entry signature
- 33433 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=439034
- ADV-2008-2661 vdb-entry
- 1020919 vdb-entry
- SSA:2008-269-02 vendor-advisory
- 256408 vendor-advisory
- 32092 third-party-advisory
- MDVSA-2008:205 vendor-advisory
- DSA-1696 vendor-advisory
- http://download.novell.com/Download?buildid=WZXONb-tqBw~
- FEDORA-2008-8429 vendor-advisory
- USN-647-1 vendor-advisory
- 32007 third-party-advisory
- RHSA-2008:0882 vendor-advisory
- 32845 third-party-advisory
- DSA-1649 vendor-advisory
- 32012 third-party-advisory
- 33434 third-party-advisory
- SSA:2008-270-01 vendor-advisory
- 32044 third-party-advisory
- RHSA-2008:0908 vendor-advisory
- 34501 third-party-advisory
- 32082 third-party-advisory