PRIOn knowledge basePRION:CVE-2008-5503Security feature bypass
The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.
References
secunia.com/advisories/33184
secunia.com/advisories/33189
secunia.com/advisories/33204
secunia.com/advisories/33205
secunia.com/advisories/33231
secunia.com/advisories/33232
secunia.com/advisories/33408
secunia.com/advisories/33415
secunia.com/advisories/33421
secunia.com/advisories/33433
secunia.com/advisories/33434
secunia.com/advisories/33523
secunia.com/advisories/33547
secunia.com/advisories/34501
secunia.com/advisories/35080
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1
www.debian.org/security/2009/dsa-1696
www.debian.org/security/2009/dsa-1697
www.debian.org/security/2009/dsa-1704
www.debian.org/security/2009/dsa-1707
www.mandriva.com/security/advisories?name=MDVSA-2008:244
www.mandriva.com/security/advisories?name=MDVSA-2009:012
www.mozilla.org/security/announce/2008/mfsa2008-61.html
www.redhat.com/support/errata/RHSA-2008-1037.html
www.redhat.com/support/errata/RHSA-2009-0002.html
www.securityfocus.com/bid/32882
www.securitytracker.com/id?1021424
www.ubuntu.com/usn/usn-690-2
www.ubuntu.com/usn/usn-701-1
www.ubuntu.com/usn/usn-701-2
www.vupen.com/english/advisories/2009/0977
bugzilla.mozilla.org/show_bug.cgi?id=379959
exchange.xforce.ibmcloud.com/vulnerabilities/47409
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11423
usn.ubuntu.com/690-3/
Related
