CVE-2002-1126

LowCVSS 2.6/10Last modified Jun 16, 2026

Description

Mozilla 1.1 and earlier, and Mozilla-based browsers such as Netscape and Galeon, set the document referrer too quickly in certain situations when a new page is being loaded, which allows web pages to determine the next page that is being visited, including manually entered URLs, using the onunload handler.

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugzilla.mozilla.org/show_bug.cgi?id=145579
http://marc.info/?l=bugtraq&m=103176760004720&w=2
http://www.iss.net/security_center/static/10084.phpVendor Advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:075
http://www.redhat.com/support/errata/RHSA-2002-192.htmlPatch, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2003-046.html
http://www.securityfocus.com/bid/5694Exploit, Patch, Vendor Advisory
http://bugzilla.mozilla.org/show_bug.cgi?id=145579
http://marc.info/?l=bugtraq&m=103176760004720&w=2
http://www.iss.net/security_center/static/10084.phpVendor Advisory
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2002:075
http://www.redhat.com/support/errata/RHSA-2002-192.htmlPatch, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2003-046.html
http://www.securityfocus.com/bid/5694Exploit, Patch, Vendor Advisory

Timeline

Published: Sep 24, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-11277.2Buffer overflow in uucp in Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long source (-s) command line parameter.CVE-2002-11287.2Buffer overflow in inc mail utility for Compaq Tru64/OSF1 3.x allows local users to execute arbitrary code via a long MH environment variabl CVE-2002-11297.2Buffer overflow in dxterm allows local users to execute arbitrary code via a long -xrm argument.CVE-2002-11317.5Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via (1) CVE-2002-11325.0SquirrelMail 1.2.7 and earlier allows remote attackers to determine the absolute pathname of the options.php script via a malformed optpage CVE-2002-11335.0Encoded directory traversal vulnerability in Dino's web server 2.1 allows remote attackers to read arbitrary files via ".." (dot dot) sequen CVE-2002-11345.0Unknown vulnerability in Compaq WEBES Service Tools 2.0 through WEBES 4.0 (Service Pack 5) allows local users to read privileged files.CVE-2002-11357.5modsecurity.php 1.10 and earlier, in phpWebSite 0.8.2 and earlier, allows remote attackers to execute arbitrary PHP source code via an inc_p CVE-2002-11377.5Buffer overflow in the Database Console Command (DBCC) that handles user inputs in Microsoft SQL Server 7.0 and 2000, including Microsoft Da CVE-2002-11387.5Microsoft SQL Server 7.0 and 2000, including Microsoft Data Engine (MSDE) 1.0 and Microsoft Desktop Engine (MSDE) 2000, writes output files CVE-2002-11395.0The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination f CVE-2002-11405.0The Sun Microsystems RPC library Services for Unix 3.0 Interix SD, as implemented on Microsoft Windows NT4, 2000, and XP, allows remote atta