| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | = 3.5.1= 3.5.10= 3.5.2= 3.5.3= 3.5.4= 3.5.5= 3.5.6= 3.5.7= 3.5.9= 3.6.1= 3.6.2= 3.6.3= 3.6.4= 3.6.6 | |
| seamonkey | = 1.0= 1.0.1= 1.0.2= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.0.9= 1.1= 1.1.1= 1.1.10= 1.1.11= 1.1.12= 1.1.13= 1.1.14= 1.1.15= 1.1.16= 1.1.17= 1.1.18= 1.1.19= 1.1.2= 1.1.3= 1.1.4= 1.1.5= 1.1.6= 1.1.7= 1.1.8= 1.1.9= 1.5.0.10= 1.5.0.8= 1.5.0.9= 2.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0a1pre≤ 2.0.5 |
The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly implement the Same Origin Policy in certain circumstances related to the about:blank document and a document that is currently loading, which allows (1) remote web servers to conduct spoofing attacks via vectors involving a 204 (aka No Content) status code, and allows (2) remote attackers to conduct spoofing attacks via vectors involving a window.stop call.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free