Oval Definition:oval:org.mitre.oval:def:1955
Revision Date:2007-05-09Version:3
Title:Mozilla Cross-site Scripting Using .valueOf.call()
Description:Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Family:windowsClass:vulnerability
Status:ACCEPTEDReference(s):CVE-2006-1731
Platform(s):Microsoft Windows 2000
Microsoft Windows Server 2003
Microsoft Windows XP
Product(s):mozilla
Definition Synopsis
  • Mozilla Firefox version 1.0.7 or earlier is installed
  • Mozilla Firefox version 1.0.7 or earlier is installed
  • AND Firefox version 1.0.7 or earlier is installed
  • OR Mozilla Thunderbird version 1.0.7 or earlier is installed
  • Mozilla Thunderbird version 1.0.7 or earlier is installed
  • AND Mozilla Thunderbird version 1.0.7 or earlier is installed
  • OR Mozilla Suite version 1.7.12 or earlier is installed
  • Mozilla Suite version 1.7.12 or earlier is installed
  • AND Mozilla Suite version 1.7.12 or earlier is installed
  • OR A pre-release of SeaMonkey 1.0 is installed
  • A pre-release of SeaMonkey 1.0 is installed
  • AND A pre-release of SeaMonkey 1.0 is installed
    • BACK