CVE:CVE-2006-1733
CNNVD:CNNVD-200604-231
Mozilla Suite/Firefox/SeaMonkey/Thunderbird都是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。
Mozilla的Firefox和Thunderbird 1.x的前1.5和1.0.x之前1.0.8，Mozilla Suite的前1.7.13和SeaMonkey 1.0之前特权的嵌入XBL绑定的编译范围没有得到正确的保护，攻击者可以通过调用valueOf.call()和alueOf.apply()，或向DOM的document.body原型链中注入XBL方式访问XBL绑定，然后编译并运行攻击者所提供的JavaScript。
solution:Upgrade mozilla firefox to a higher version than 1.0.7,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.5,1.5:beta1,1.5:beta2,and avoid the version (,1.0.7],1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.5,1.5:beta1,1.5:beta2; Upgrade mozilla mozilla_suite to a higher version than 1.7.12,1.7.6,1.7.7,1.7.8,1.7.10,1.7.11,and avoid the version (,1.7.12],1.7.6,1.7.7,1.7.8,1.7.10,1.7.11; Upgrade mozilla seamonkey to a higher version than *:beta,1.0,and avoid the version *:beta,1.0; Upgrade mozilla thunderbird to a higher version than 1.0.7,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.5:beta,1.0.6,1.5,1.5:beta2,and avoid the version (,1.0.7],1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.5:beta,1.0.6,1.5,1.5:beta2