Mozilla Foundation Security Advisory 2007-16
XSS using addEventListener
- Announced
- May 30, 2007
- Reporter
- moz_bug_r_a4
- Impact
- High
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 1.5.0.12
- Firefox 2.0.0.4
- SeaMonkey 1.0.9
- SeaMonkey 1.1.2
Description
Mozilla contributor moz_bug_r_a4 demonstrated that
the addEventListener method could be used to inject
script into another site in violation of the browser's same-origin
policy. This could be used to access or modify private or valuable
information from that other site.
Workaround
Disable JavaScript until a fixed version can be installed.