Attachment 41641 Details for Bug 88509

mfsa2005-46

mfsa2005-46.html (text/html), 1.52 KB, created by Wolfgang Rosenauer on 2005-07-12 10:33:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Wolfgang Rosenauer

Created: 2005-07-12 10:33:09 UTC

Size: 1.52 KB

patch

obsolete

><html>
>  <head>
>    <title>MFSA 2005-46: XBL scripts ran even when Javascript disabled</title>
>    <style>
>       .label { width: 8em; font-weight: bold; float: left;}
>    </style>
>  </head>
><body>
><h1>Mozilla Foundation Security Advisory 2005-46</h1>
>
><span class="label">Title:</span>      XBL scripts ran even when Javascript disabled<br>
><span class="label">Severity:</span>   Low<br>
><span class="label">Reporter:</span>   moz_bug_r_a4<br>
><span class="label">Products:</span>   Firefox, Thunderbird, Mozilla Suite<br>
><br>
><span class="label">Fixed in:</span>   Firefox 1.0.5<br>
><span class="label">&nbsp;</span>      Thunderbird 1.0.5<br>
><span class="label">&nbsp;</span>      Mozilla Suite 1.7.9<br>
>
><h3>Description</h3>
>
>Scripts in XBL controls from web content continued to be run even when
>Javascript was disabled. By itself this causes no harm, but it could be
>combined with most script-based exploits to attack people running
>vulnerable versions who thought disabling javascript would protect them.
><p>
>In the Thunderbird and Mozilla Suite mail clients Javascript is disabled by
>default for protection against denial-of-service attacks and worms; this
>vulnerability could be used to bypass that protection.
>
><h3>Workaround</h3>
>
>Upgrade to a fixed version
>
><h3>References</h3>
>
><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=292591">
>https://bugzilla.mozilla.org/show_bug.cgi?id=292591</a><br>
>
><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=292589">
>https://bugzilla.mozilla.org/show_bug.cgi?id=292589</a><br>
>
></body>
></html>

<html>
  <head>
    <title>MFSA 2005-46: XBL scripts ran even when Javascript disabled</title>
    <style>
       .label { width: 8em; font-weight: bold; float: left;}
    </style>
  </head>
<body>
<h1>Mozilla Foundation Security Advisory 2005-46</h1>

<span class="label">Title:</span>      XBL scripts ran even when Javascript disabled<br>
<span class="label">Severity:</span>   Low<br>
<span class="label">Reporter:</span>   moz_bug_r_a4<br>
<span class="label">Products:</span>   Firefox, Thunderbird, Mozilla Suite<br>
<br>
<span class="label">Fixed in:</span>   Firefox 1.0.5<br>
<span class="label">&nbsp;</span>      Thunderbird 1.0.5<br>
<span class="label">&nbsp;</span>      Mozilla Suite 1.7.9<br>

<h3>Description</h3>

Scripts in XBL controls from web content continued to be run even when
Javascript was disabled. By itself this causes no harm, but it could be
combined with most script-based exploits to attack people running
vulnerable versions who thought disabling javascript would protect them.
<p>
In the Thunderbird and Mozilla Suite mail clients Javascript is disabled by
default for protection against denial-of-service attacks and worms; this
vulnerability could be used to bypass that protection.

<h3>Workaround</h3>

Upgrade to a fixed version

<h3>References</h3>

<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=292591">
https://bugzilla.mozilla.org/show_bug.cgi?id=292591</a><br>

<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=292589">
https://bugzilla.mozilla.org/show_bug.cgi?id=292589</a><br>

</body>
</html>

Actions: View

Attachments on bug 88509: 41640 | 41641 | 41642 | 41643 | 41644 | 41645 | 41646 | 41647 | 41648 | 41649 | 41650 | 41651