CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
Percentile
99.5%
The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user’s localstore.rdf file.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 999 | all | firefox | < 1.5.dfsg+1.5.0.1-1 | firefox_1.5.dfsg+1.5.0.1-1_all.deb |
Debian | 12 | all | thunderbird | < 1.5.0.2-1 | thunderbird_1.5.0.2-1_all.deb |
Debian | 11 | all | thunderbird | < 1.5.0.2-1 | thunderbird_1.5.0.2-1_all.deb |
Debian | 999 | all | thunderbird | < 1.5.0.2-1 | thunderbird_1.5.0.2-1_all.deb |
Debian | 13 | all | thunderbird | < 1.5.0.2-1 | thunderbird_1.5.0.2-1_all.deb |