Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 does not properly verify the associated types of DOM node names within the context of their namespaces, which allows remote attackers to modify certain tag properties, possibly leading to execution of arbitrary script or code, as demonstrated using an XHTML document with IMG tags with custom properties ("XHTML node spoofing").
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade mozilla+ipv6Upgrade mozilla-gtk1Upgrade linux-netscapeUpgrade fr-netscape7Upgrade pt_BR-netscape7Upgrade fr-linux-netscapeUpgrade linux-firefoxUpgrade zhCN-linux-mozillafirebirdUpgrade de-netscape7Upgrade mozilla-gtk2Upgrade de-linux-netscapeUpgrade phoenixUpgrade linux-phoenixUpgrade linux-mozillaUpgrade mozilla-embeddedUpgrade mozilla-firebirdUpgrade ru-linux-mozillafirebirdUpgrade ja-mozillafirebird-gtk2Upgrade ja-linux-mozillafirebird-gtk1Upgrade ja-netscape7Upgrade mozilla-gtkUpgrade ja-linux-netscapeUpgrade netscape7Upgrade linux-mozilla-develUpgrade el-linux-mozillafirebirdUpgrade firefoxUpgrade linux-mozillafirebirdUpgrade mozillaUpgrade de-linux-mozillafirebirdUpgrade mozilla-thunderbirdUpgrade zhTW-linux-mozillafirebird | Dec 10, 2025 | Jul 16, 2005 |
| Ubuntu | — | Upgrade mozilla-firefox-locale-nbUpgrade mozilla-firefox-locale-jaUpgrade mozilla-firefox-locale-ukUpgrade mozilla-thunderbirdUpgrade mozilla-firefoxUpgrade mozilla-firefox-locale-trUpgrade mozilla-browser | Nov 8, 2024 | Jul 13, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub