Description
mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the recipient, or comments in forwarded mail, via script that reads the (1) .documentURI or (2) .textContent DOM properties.
References
- 32363 vdb-entry
- mozilla-domproperties-info-disclosure(46734) vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=458883
- http://www.mozilla.org/security/announce/2008/mfsa2008-59.html
- 32715 third-party-advisory
- 1021247 vdb-entry
- 32714 third-party-advisory