|Description||Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly restrict read access to object properties in showModalDialog, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via crafted dialogArguments values.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||medium (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
|iceweasel (PTS)||wheezy (security), wheezy||38.8.0esr-1~deb7u1||fixed|
|jessie (security), jessie||38.8.0esr-1~deb8u1||fixed|
|xulrunner (PTS)||wheezy (security), wheezy||24.8.1esr-2~deb7u1||fixed|
The information below is based on the following data on fixed versions.
[lenny] - iceweasel <not-affected> (Iceweasel in Lenny links against xulrunner)
[lenny] - iceape <not-affected> (Lenny package only provide xpcom stubs)