CVE-2005-2266
First published: Wed Jul 13 2005(Updated: )
Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | =0.8 | |
| Firefox | =0.9 | |
| Firefox | =0.9-rc | |
| Firefox | =0.9.1 | |
| Firefox | =0.9.2 | |
| Firefox | =0.9.3 | |
| Firefox | =0.10 | |
| Firefox | =0.10.1 | |
| Firefox | =1.0 | |
| Firefox | =1.0.1 | |
| Firefox | =1.0.2 | |
| Firefox | =1.0.3 | |
| Firefox | =1.0.4 | |
| Mozilla Firefox | =1.3 | |
| Mozilla Firefox | =1.4 | |
| Mozilla Firefox | =1.4-alpha | |
| Mozilla Firefox | =1.4.1 | |
| Mozilla Firefox | =1.5 | |
| Mozilla Firefox | =1.5-alpha | |
| Mozilla Firefox | =1.5-rc1 | |
| Mozilla Firefox | =1.5-rc2 | |
| Mozilla Firefox | =1.5.1 | |
| Mozilla Firefox | =1.6 | |
| Mozilla Firefox | =1.6-alpha | |
| Mozilla Firefox | =1.6-beta | |
| Mozilla Firefox | =1.7 | |
| Mozilla Firefox | =1.7-alpha | |
| Mozilla Firefox | =1.7-beta | |
| Mozilla Firefox | =1.7-rc1 | |
| Mozilla Firefox | =1.7-rc2 | |
| Mozilla Firefox | =1.7-rc3 | |
| Mozilla Firefox | =1.7.1 | |
| Mozilla Firefox | =1.7.2 | |
| Mozilla Firefox | =1.7.3 | |
| Mozilla Firefox | =1.7.5 | |
| Mozilla Firefox | =1.7.6 | |
| Mozilla Firefox | =1.7.7 | |
| Mozilla Firefox | =1.7.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.mozilla.org/security/announce/mfsa2005-52.html
- http://secunia.com/advisories/15549
- http://www.securityfocus.com/bid/14242
- http://secunia.com/advisories/15551
- http://secunia.com/advisories/15553
- http://www.debian.org/security/2005/dsa-810
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=160202
- http://www.redhat.com/support/errata/RHSA-2005-586.html
- http://www.redhat.com/support/errata/RHSA-2005-587.html
- http://www.redhat.com/support/errata/RHSA-2005-601.html
- http://secunia.com/advisories/19823
- http://www.novell.com/linux/security/advisories/2005_45_mozilla.html
- http://www.novell.com/linux/security/advisories/2005_18_sr.html
- http://www.novell.com/linux/security/advisories/2006_04_25.html
- http://www.vupen.com/english/advisories/2005/1075
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21332
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A773
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1415
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10712
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100107
Frequently Asked Questions
What is the severity of CVE-2005-2266?
CVE-2005-2266 is classified as a medium-severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2005-2266?
To fix CVE-2005-2266, upgrade to Mozilla Firefox version 1.0.5 or later and Mozilla version 1.7.9 or later.
What does CVE-2005-2266 exploit?
CVE-2005-2266 exploits a flaw in the same origin policy, allowing a child frame to access elements in a parent frame from a different domain.
What types of information can be stolen due to CVE-2005-2266?
CVE-2005-2266 can allow remote attackers to steal sensitive information such as cookies and passwords.
Which versions are affected by CVE-2005-2266?
CVE-2005-2266 affects various versions of Mozilla Firefox prior to 1.0.5 and various versions of Mozilla prior to 1.7.9.
- agent/references
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/author
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/mozilla
- canonical/firefox
- version/firefox/0.8
- version/firefox/0.9
- version/firefox/0.9-rc
- version/firefox/0.9.1
- version/firefox/0.9.2
- version/firefox/0.9.3
- version/firefox/0.10
- version/firefox/0.10.1
- version/firefox/1.0
- version/firefox/1.0.1
- version/firefox/1.0.2
- version/firefox/1.0.3
- version/firefox/1.0.4
- canonical/mozilla firefox
- version/mozilla firefox/1.3
- version/mozilla firefox/1.4
- version/mozilla firefox/1.4-alpha
- version/mozilla firefox/1.4.1
- version/mozilla firefox/1.5
- version/mozilla firefox/1.5-alpha
- version/mozilla firefox/1.5-rc1
- version/mozilla firefox/1.5-rc2
- version/mozilla firefox/1.5.1
- version/mozilla firefox/1.6
- version/mozilla firefox/1.6-alpha
- version/mozilla firefox/1.6-beta
- version/mozilla firefox/1.7
- version/mozilla firefox/1.7-alpha
- version/mozilla firefox/1.7-beta
- version/mozilla firefox/1.7-rc1
- version/mozilla firefox/1.7-rc2
- version/mozilla firefox/1.7-rc3
- version/mozilla firefox/1.7.1
- version/mozilla firefox/1.7.2
- version/mozilla firefox/1.7.3
- version/mozilla firefox/1.7.5
- version/mozilla firefox/1.7.6
- version/mozilla firefox/1.7.7
- version/mozilla firefox/1.7.8