You are currently viewing a snapshot of taken on April 21, 2008. Most of this content is highly out of date (some pages haven't been updated since the project began in 1998) and exists for historical purposes only. If there are any pages on this archive site that you think should be added back to, please file a bug.

You are here: Known Vulnerabilities in Mozilla Products (Thunderbird > MFSA 2006-63

Mozilla Foundation Security Advisory 2006-63

Title: JavaScript execution in mail via XBL
Impact: High
Announced: September 14, 2006
Reporter: Georgi Guninski
Products: Thunderbird, SeaMonkey

Fixed in: Thunderbird
  SeaMonkey 1.0.5


Georgi Guninski demonstrated that even with JavaScript disabled in mail (the default) an attacker can still execute JavaScript when a mail message is viewed, replied to, or forwarded by putting the script in a remote XBL file loaded by the message. The executed script could be used to alter or change the appearance of the message, and can act as a "mail-tap" to spy on the contents added to a reply or forward. For example, the attacker could make a provocative offer to a rival business and then watch the internal debate as it was forwarded and replied to.

The victim would have to have chosen to "Load Images"--either for the individual message or as the default setting -- in order for the XBL file to be loaded and the JavaScript executed.


The problem can be avoided in the message window by not viewing the original HTML of mail messages. Use the "Simple HTML" or plain text options on the "Message Body As" View menu item instead.

Similarly, avoid the problem when composing a reply or forward by unchecking the "Compose messages in HTML format" option in Account Settings to use the plain text editor.