oval:org.mitre.oval:def:1955

Definition Id: oval:org.mitre.oval:def:1955

Oval ID:	oval:org.mitre.oval:def:1955
Title:	Mozilla Cross-site Scripting Using .valueOf.call()
Description:	Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1731	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003	Product(s):	mozilla
Definition Synopsis:
Mozilla Firefox version 1.0.7 or earlier is installed Mozilla Firefox version 1.0.7 or earlier is installed AND Firefox version 1.0.7 or earlier is installed OR Mozilla Thunderbird version 1.0.7 or earlier is installed Mozilla Thunderbird version 1.0.7 or earlier is installed AND Mozilla Thunderbird version 1.0.7 or earlier is installed OR Mozilla Suite version 1.7.12 or earlier is installed Mozilla Suite version 1.7.12 or earlier is installed AND Mozilla Suite version 1.7.12 or earlier is installed OR A pre-release of SeaMonkey 1.0 is installed A pre-release of SeaMonkey 1.0 is installed AND A pre-release of SeaMonkey 1.0 is installed