Description
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | iceape | 2.0.11-3 | DSA-2180-1 |
| Debian 6.0 | icedove | 3.0.11-1+squeeze1 | DSA-2187-1 |
| Debian 6.0 | iceweasel | 3.5.16-5 | DSA-2186-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | firefox | 3.6.14-4.el6_0 | RHSA-2011:0310 |
| RHEL 6 | thunderbird | 3.1.8-4.el6_0 | RHSA-2011:0311 |
| RHEL 6 | xulrunner +1 | 1.9.2.14-3.el6_0 | RHSA-2011:0310 |
| RHEL 5 | firefox | 3.6.14-4.el5_6 | RHSA-2011:0310 |
| RHEL 5 | xulrunner +1 | 1.9.2.14-4.el5_6 | RHSA-2011:0310 |
| RHEL 4 | firefox | 3.6.14-4.el4 | RHSA-2011:0310 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
Advisories 6
- RHSA-2011:0311 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0310 Red Hat Security Advisory: firefox security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2180-1 iceape - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2186-1 iceweasel - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2187-1 icedove - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://downloads.avaya.com/css/P8/documents/100133195
- https://bugzilla.mozilla.org/show_bug.cgi?id=562547
- 20100421 Security-Assessment.com WhitePaper/Addendum: Cross Context Scripting with Firefox & Exploiting Cross Context Scripting vulnerabilities in Firefox mailing-list
- MDVSA-2011:041 vendor-advisory
- oval:org.mitre.oval:def:12532 vdb-entry signature
- http://www.security-assessment.com/files/whitepapers/Cross_Context_Scripting_with_Firefox.pdf
- http://www.mozilla.org/security/announce/2011/mfsa2011-08.html
- http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/
- MDVSA-2011:042 vendor-advisory