| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | = 1.5≥ 1.0, < 1.0.8 | 1.0.8 |
| mozilla suite | < 1.7.13 | 1.7.13 |
| seamonkey | < 1.0 | 1.0 |
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free