CVE-2008-5503

The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.

🔗 References (72)

• secalert@redhathttp://secunia.com/advisories/33184
• secalert@redhathttp://secunia.com/advisories/33189
• secalert@redhathttp://secunia.com/advisories/33204
• secalert@redhathttp://secunia.com/advisories/33205
• secalert@redhathttp://secunia.com/advisories/33231
• secalert@redhathttp://secunia.com/advisories/33232
• secalert@redhathttp://secunia.com/advisories/33408
• secalert@redhathttp://secunia.com/advisories/33415
• secalert@redhathttp://secunia.com/advisories/33421
• secalert@redhathttp://secunia.com/advisories/33433
• secalert@redhathttp://secunia.com/advisories/33434
• secalert@redhathttp://secunia.com/advisories/33523
• secalert@redhathttp://secunia.com/advisories/33547
• secalert@redhathttp://secunia.com/advisories/34501
• secalert@redhathttp://secunia.com/advisories/35080