ID CVE-2006-1741
Type cve
Modified 2018-10-18T16:35:00


Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.proto to extend eval, aka "cross-site JavaScript injection". Fixed in: Firefox 1.5 Firefox 1.0.8 Mozilla Suite 1.7.13 SeaMonkey 1.0