The jar protocol handler in Mozilla Firefox prior to 2.0.0.10 and SeaMonkey prior to 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote malicious users to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
mozilla firefox |
||
mozilla seamonkey |
Vulmon