Description
Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/bid/12659 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10682 ↗
- http://www.redhat.com/support/errata/RHSA-2005-176.html ↗
- http://www.mozilla.org/security/announce/mfsa2005-20.html ↗
- http://www.redhat.com/support/errata/RHSA-2005-384.html ↗
- http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100038 ↗
- https://bugzilla.mozilla.org/show_bug.cgi?id=271209 ↗
- http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml ↗