CVE ID:	CVE-2006-0296
Description:	The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.
Test IDs:	1.3.6.1.4.1.25623.1.0.56667   1.3.6.1.4.1.25623.1.0.56664   1.3.6.1.4.1.25623.1.0.56672   1.3.6.1.4.1.25623.1.0.56238   1.3.6.1.4.1.25623.1.0.56237
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2006-0296 1015570 http://securitytracker.com/id?1015570 102550 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1 16476 http://www.securityfocus.com/bid/16476 18700 http://secunia.com/advisories/18700 18703 http://secunia.com/advisories/18703 18704 http://secunia.com/advisories/18704 18705 http://secunia.com/advisories/18705 18706 http://secunia.com/advisories/18706 18708 http://secunia.com/advisories/18708 18709 http://secunia.com/advisories/18709 19230 http://secunia.com/advisories/19230 19746 http://secunia.com/advisories/19746 19759 http://secunia.com/advisories/19759 19780 http://secunia.com/advisories/19780 19821 http://secunia.com/advisories/19821 19823 http://secunia.com/advisories/19823 19852 http://secunia.com/advisories/19852 19862 http://secunia.com/advisories/19862 19863 http://secunia.com/advisories/19863 19902 http://secunia.com/advisories/19902 19941 http://secunia.com/advisories/19941 19950 http://secunia.com/advisories/19950 20051 http://secunia.com/advisories/20051 20060201-01-U ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U 21033 http://secunia.com/advisories/21033 21622 http://secunia.com/advisories/21622 22065 http://secunia.com/advisories/22065 228526 http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1 ADV-2006-0413 http://www.vupen.com/english/advisories/2006/0413 ADV-2006-3391 http://www.vupen.com/english/advisories/2006/3391 ADV-2006-3749 http://www.vupen.com/english/advisories/2006/3749 DSA-1044 http://www.debian.org/security/2006/dsa-1044 DSA-1046 http://www.debian.org/security/2006/dsa-1046 DSA-1051 http://www.debian.org/security/2006/dsa-1051 FEDORA-2006-075 http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00005.html FEDORA-2006-076 http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00006.html FLSA-2006:180036-2 http://www.securityfocus.com/archive/1/425978/100/0/threaded FLSA:180036-1 http://www.securityfocus.com/archive/1/425975/100/0/threaded GLSA-200604-12 http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml GLSA-200604-18 http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml GLSA-200605-09 http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml HPSBUX02122 http://www.securityfocus.com/archive/1/438730/100/0/threaded HPSBUX02156 http://www.securityfocus.com/archive/1/446657/100/200/threaded MDKSA-2006:036 http://www.mandriva.com/security/advisories?name=MDKSA-2006:036 MDKSA-2006:037 http://www.mandriva.com/security/advisories?name=MDKSA-2006:037 MDKSA-2006:078 http://www.mandriva.com/security/advisories?name=MDKSA-2006:078 RHSA-2006:0199 http://www.redhat.com/support/errata/RHSA-2006-0199.html RHSA-2006:0200 http://www.redhat.com/support/errata/RHSA-2006-0200.html RHSA-2006:0330 http://www.redhat.com/support/errata/RHSA-2006-0330.html SCOSA-2006.26 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt SSRT061158 http://www.securityfocus.com/archive/1/438730/100/0/threaded SSRT061236 http://www.securityfocus.com/archive/1/446657/100/200/threaded SUSE-SA:2006:022 http://www.novell.com/linux/security/advisories/2006_04_25.html TA06-038A http://www.us-cert.gov/cas/techalerts/TA06-038A.html USN-271-1 https://usn.ubuntu.com/271-1/ USN-275-1 https://usn.ubuntu.com/275-1/ USN-276-1 https://usn.ubuntu.com/276-1/ VU#592425 http://www.kb.cert.org/vuls/id/592425 http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm http://www.mozilla.org/security/announce/2006/mfsa2006-05.html http://www.mozilla.org/security/announce/2006/mfsa2006-05.html https://bugzilla.mozilla.org/show_bug.cgi?id=319847 https://bugzilla.mozilla.org/show_bug.cgi?id=319847 mozilla-xuldocument-command-execution(24434) https://exchange.xforce.ibmcloud.com/vulnerabilities/24434 oval:org.mitre.oval:def:11803 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11803 oval:org.mitre.oval:def:1493 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1493