You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2013-58

Mozilla Foundation Security Advisory 2013-58

Title: X-Frame-Options ignored when using server push with multi-part responses
Impact: Moderate
Announced: June 25, 2013
Reporter: Frédéric Buclin
Products: Firefox, Seamonkey

Fixed in: Firefox 22.0
  SeaMonkey 2.19

Description

Bugzilla developer Frédéric Buclin reported that the X-Frame-Options header is ignored when server push is used in multi-part responses. This can lead to potential clickjacking on sites that use X-Frame-Options as a protection.

References