Mozilla

mozilla

Mozilla Foundation Security Advisory 2012-76

Continued access to initial origin after setting document.domain

Announced
October 9, 2012
Reporter
Collin Jackson
Impact
High
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 16
  • SeaMonkey 2.13
  • Thunderbird 16

Description

Security researcher Collin Jackson reported a violation of the HTML5 specifications for document.domain behavior. Specified behavior requires pages to only have access to windows in a new document.domain but the observed violation allowed pages to retain access to windows from the page's initial origin in addition to the new document.domain. This could potentially lead to cross-site scripting (XSS) attacks.

In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products.

References