The host is installed with Mozilla firefox/thunderbird/seamonkey and is prone to same origin policy bypass vulnerability.

Successful exploitation will let attackers to bypass the same-origin policy, execute arbitrary script code, obtain potentially sensitive information, or launch spoofing attacks against other sites. Impact Level: System/Application

Upgrade to Mozilla Firefox version 3.6.23 or 6.0 or later, For updates refer to http://www.mozilla.com/en-US/firefox/all.html Upgrade to SeaMonkey version to 2.3 or later http://www.mozilla.org/projects/seamonkey/ Upgrade to Thunderbird version to 6.0 or later http://www.mozilla.org/en-US/thunderbird/

The flaw is due to some plugins, which use the value of 'window.location' to determine the page origin this could fool the plugin into granting the plugin content access to another site or the local file system in violation of the Same Origin Policy.

SeaMonkey version prior to 2.3 Thunderbird version prior to 6.0 Mozilla Firefox before 3.6.23 and 4.x through 5

• http://www.mozilla.org/security/announce/2011/mfsa2011-38.html

---

Updated on 2015-03-25