Mozilla Foundation Security Advisory 2012-51
X-Frame-Options header ignored when duplicated
- Announced
- July 17, 2012
- Reporter
- Frédéric Buclin
- Impact
- Moderate
- Products
- Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR
- Fixed in
-
- Firefox 14
- Firefox ESR 10.0.6
- SeaMonkey 2.11
- Thunderbird 14
- Thunderbird ESR 10.0.6
Description
Bugzilla developer Frédéric Buclin reported that the
"X-Frame-Options header is ignored when the value is duplicated,
for example X-Frame-Options: SAMEORIGIN, SAMEORIGIN. This
duplication occurs for unknown reasons on some websites and when it occurs
results in Mozilla browsers not being protected against possible clickjacking
attacks on those pages