• Security Center
  • Security Advisories
  • Known Vulnerabilities
  • Bug Bounty
  • Security Blog

You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2013-58

Mozilla Foundation Security Advisory 2013-58

Title: X-Frame-Options ignored when using server push with multi-part responses
Impact: Moderate
Announced: June 25, 2013
Reporter: Frédéric Buclin
Products: Firefox, Seamonkey

Fixed in: Firefox 22.0
  SeaMonkey 2.19

Description

Bugzilla developer Frédéric Buclin reported that the X-Frame-Options header is ignored when server push is used in multi-part responses. This can lead to potential clickjacking on sites that use X-Frame-Options as a protection.

References

• Firefox ignores the X-Frame-Options header when using server push (CVE-2013-1696)