| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | = 0.1= 0.10= 0.10.1= 0.2= 0.3= 0.4= 0.5= 0.6= 0.6.1= 0.7= 0.7.1= 0.8= 0.9= 0.9.1= 0.9.2= 0.9.3= 0.9_rc= 1.0= 1.0.1= 1.0.2= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.5= 1.5.0.1= 1.5.0.10= 1.5.0.11= 1.5.0.12= 1.5.0.2= 1.5.0.3= 1.5.0.4= 1.5.0.5= 1.5.0.6= 1.5.0.7= 1.5.0.8= 1.5.0.9= 1.5.1= 1.5.2= 1.5.3= 1.5.4= 1.5.5= 1.5.6= 1.5.7= 1.5.8= 1.8= 2.0= 2.0.0.1= 2.0.0.10= 2.0.0.11= 2.0.0.12= 2.0.0.13= 2.0.0.14= 2.0.0.15= 2.0.0.16= 2.0.0.17= 2.0.0.18= 2.0.0.19= 2.0.0.2= 2.0.0.20= 2.0.0.21= 2.0.0.3= 2.0.0.4= 2.0.0.5= 2.0.0.6= 2.0.0.7= 2.0.0.8= 2.0.0.9= 2.0_.1= 2.0_.10= 2.0_.4= 2.0_.5= 2.0_.6= 2.0_.7= 2.0_.9= 2.0_8= 3.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5= 3.0.6= 3.0.7= 3.0beta5≤ 3.0.8 |
Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free