Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2006-63

JavaScript execution in mail via XBL

Announced
September 14, 2006
Reporter
Georgi Guninski
Impact
High
Products
SeaMonkey, Thunderbird
Fixed in
  • SeaMonkey 1.0.5
  • Thunderbird 1.5.0.7

Description

Georgi Guninski demonstrated that even with JavaScript disabled in mail (the default) an attacker can still execute JavaScript when a mail message is viewed, replied to, or forwarded by putting the script in a remote XBL file loaded by the message. The executed script could be used to alter or change the appearance of the message, and can act as a "mail-tap" to spy on the contents added to a reply or forward. For example, the attacker could make a provocative offer to a rival business and then watch the internal debate as it was forwarded and replied to.

The victim would have to have chosen to "Load Images"--either for the individual message or as the default setting -- in order for the XBL file to be loaded and the JavaScript executed.

Workaround

The problem can be avoided in the message window by not viewing the original HTML of mail messages. Use the "Simple HTML" or plain text options on the "Message Body As" View menu item instead.

Similarly, avoid the problem when composing a reply or forward by unchecking the "Compose messages in HTML format" option in Account Settings to use the plain text editor.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=346984
CVE-2006-4570