The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly implement the Same Origin Policy in certain circumstances related to the about:blank document and a document that is currently loading, which allows (1) remote web servers to conduct spoofing attacks via vectors involving a 204 (aka No Content) status code, and allows (2) remote attackers to conduct spoofing attacks via vectors involving a window.stop call.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade xulrunner-develUpgrade xulrunner | Dec 1, 2016 | Jun 25, 2010 |
| Freebsd | — | Upgrade firefoxUpgrade thunderbirdUpgrade seamonkeyUpgrade linux-firefox-develUpgrade linux-firefox | Dec 10, 2025 | Jul 21, 2010 |
| Gentoo Linux | — | Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/icecat.Upgrade www-client/firefox.Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner.Upgrade dev-libs/nss.Upgrade www-client/seamonkey-bin.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Jun 25, 2010 |
| Mfsa2010 45 | — | Upgrade to Mozilla Firefox version 3.6.7Upgrade to Mozilla Firefox version 3.5.11 | Jun 14, 2012 | Jun 25, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.6 | Feb 3, 2012 | Jun 25, 2010 |
| Oracle_linux | — | Upgrade firefoxUpgrade xulrunnerUpgrade xulrunner-devel | Oct 16, 2024 | Jun 25, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 2, 2010 |
| Suse | — | Upgrade mozilla-nss-32bitUpgrade libidl-32bitUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner190-translationsUpgrade orbit2-32bitUpgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner192-translations-32bitUpgrade mozilla-xulrunner190-gnomevfsUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-xulrunner191-x86Upgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner192Upgrade libfreebl3Upgrade orbit2Upgrade mozilla-nsprUpgrade mozilla-nspr-x86Upgrade mozilla-xulrunner192-develUpgrade MozillaFirefox-translationsUpgrade mozilla-nssUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-xulrunner192-32bitUpgrade orbit2-x86Upgrade libidl-x86Upgrade mozilla-xulrunner190-x86Upgrade mozilla-xulrunner192-x86Upgrade mozilla-nss-toolsUpgrade mozilla-xulrunner190-32bitUpgrade MozillaFirefox-develUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner191-gnomevfsUpgrade libfreebl3-x86Upgrade gconf2-32bitUpgrade libfreebl3-32bitUpgrade gconf2-x86Upgrade gconf2Upgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner191Upgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-x86Upgrade MozillaFirefoxUpgrade libidl | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade firefox-3.5Upgrade firefox-3.0Upgrade xulrunner-1.9.2Upgrade abrowser | Nov 8, 2024 | Jun 25, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub