|Description||The (1) Password Manager in Mozilla Firefox 2.0, and 18.104.22.168 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||medium (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
|iceweasel (PTS)||wheezy (security), wheezy||38.8.0esr-1~deb7u1||fixed|
|jessie (security), jessie||38.8.0esr-1~deb8u1||fixed|
|xulrunner (PTS)||wheezy (security), wheezy||24.8.1esr-2~deb7u1||fixed|
The information below is based on the following data on fixed versions.
[sarge] - mozilla-firefox <no-dsa> (Mozilla products from Sarge no longer supported)
[sarge] - mozilla <no-dsa> (Mozilla products from Sarge no longer supported)
Epiphany affected by xulrunner