oval:org.mitre.oval:def:2020

Definition Id: oval:org.mitre.oval:def:2020

Oval ID:	oval:org.mitre.oval:def:2020
Title:	Mozilla Accessing XBL Compilation Scope via valueOf.call()
Description:	Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1733	Version:	3
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003	Product(s):	mozilla
Definition Synopsis:
Mozilla Firefox version 1.0.7 or earlier is installed Mozilla Firefox version 1.0.7 or earlier is installed AND Firefox version 1.0.7 or earlier is installed OR Mozilla Thunderbird version 1.0.7 or earlier is installed Mozilla Thunderbird version 1.0.7 or earlier is installed AND Mozilla Thunderbird version 1.0.7 or earlier is installed OR Mozilla Suite version 1.7.12 or earlier is installed Mozilla Suite version 1.7.12 or earlier is installed AND Mozilla Suite version 1.7.12 or earlier is installed OR A pre-release of SeaMonkey 1.0 is installed A pre-release of SeaMonkey 1.0 is installed AND A pre-release of SeaMonkey 1.0 is installed