CVE-2006-0296

NameCVE-2006-0296
DescriptionThe XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1044-1, DSA-1046-1, DSA-1051-1
NVD severitymedium (attack range: remote)
Debian Bugs351442
Debian/oldstablenot known to be vulnerable.
Debian/stablenot known to be vulnerable.
Debian/testingnot known to be vulnerable.
Debian/unstablenot known to be vulnerable.

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)1.5.dfsg+1.5.0.1-1medium351442
mozillasource(unstable)2:1.7.13-0.1medium
mozillasourcesarge2:1.7.8-1sarge5mediumDSA-1046-1
mozilla-firefoxsourcesarge1.0.4-2sarge6mediumDSA-1044-1
mozilla-thunderbirdsourcesarge1.0.2-2.sarge1.0.8mediumDSA-1051-1
thunderbirdsource(unstable)1.5.0.2-1medium

Search for package or bug name: Reporting problems