CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.8
CWE Name:  Permissions Privileges and Access Controls
Summary: mozilla firefox and thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, mozilla suite before 1.7.13, and seamonkey before 1.0 does not properly protect the compilation scope of privileged built-in xbl bindings, which allows remote attackers to execute arbitrary code via the (1) valueof.call or (2) valueof.apply methods of an xbl binding, or (3) "by inserting an xbl method into the dom's document.body prototype chain." this vulnerability also affects mozilla, seamonkey, 1.0 and mozilla, suite, 1.7.13

this vulnerabiloity is addressed in the following product releases:
mozilla, firefox, 1.5
mozilla, firefox, 1.0.8
mozilla, thunderbird, 1.5
mozilla, thunderbird, 1.0.8
mozilla, seamonkey, 1.0
mozilla, suite, 1.7.13
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2006-04-14
Last Modified Date: 2018-10-18