CVE-2005-1476

Related Files

Gentoo Linux Security Advisory 200505-11

Posted Jul 2, 2005

Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory GLSA 200505-11 - The Mozilla Suite and Firefox do not properly protect IFRAME JavaScript URLs from being executed in context of another URL in the history list (CVE-2005-1476). The Mozilla Suite and Firefox also fail to verify the IconURL parameter of the InstallTrigger.install() function (CVE-2005-1477). Michael Krax and Georgi Guninski discovered that it is possible to bypass JavaScript-injection security checks by wrapping the javascript: URL within the view-source: or jar: pseudo-protocols (MFSA2005-43). Versions less than 1.0.4 are affected.

tags | advisory, javascript, protocol

systems | linux, gentoo

advisories | CVE-2005-1476, CVE-2005-1477

SHA-256 | 6b81a217ce3f87b99e5aadf53821e66be801d2bc37dc498629b18c3918b3ad7c

Download | Favorite | View