CVE:CVE-2008-5506
CNNVD:CNNVD-200812-360
Firefox是Mozilla所发布的开源WEB浏览器。
 如果对302重新定向到不同域中资源的同源资源执行了XMLHttpRequest请求的话，跨域资源的响应是发布XHR的站点可读的。标记为HttpOnly的Cookie不可读，但XHR响应可能泄露其他敏感数据，包括响应体中的URL参数和内容。
solution:Upgrade mozilla firefox to a higher version than 2.0.0.19,3.0.5,and avoid the version [2.0,2.0.0.19),[3.0,3.0.5); Upgrade mozilla seamonkey to a higher version than 1.1.14,and avoid the version [1.0,1.1.14); Upgrade mozilla thunderbird to a higher version than 2.0.0.19,and avoid the version [2.0,2.0.0.19); Upgrade canonical ubuntu_linux to a higher version than 6.06,7.10,8.04,8.10,and avoid the version 6.06,7.10,8.04,8.10; Upgrade debian debian_linux to a higher version than 4.0,5.0,and avoid the version 4.0,5.0