• Security Center
  • Security Advisories
  • Known Vulnerabilities
  • Bug Bounty
  • Security Blog

You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2012-76

Mozilla Foundation Security Advisory 2012-76

Title: Continued access to initial origin after setting document.domain
Impact: High
Announced: October 9, 2012
Reporter: Collin Jackson
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 16
  Thunderbird 16
  SeaMonkey 2.13

Description

Security researcher Collin Jackson reported a violation of the HTML5 specifications for document.domain behavior. Specified behavior requires pages to only have access to windows in a new document.domain but the observed violation allowed pages to retain access to windows from the page's initial origin in addition to the new document.domain. This could potentially lead to cross-site scripting (XSS) attacks.

In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products.

References

• Script access checks should use effective script origin, not origin
• CVE-2012-3985