Gentoo Linux Security Advisory GLSA 200505-11 – The Mozilla Suite and Firefox do not properly protect IFRAME JavaScript URLs from being executed in context of another URL in the history list (CVE-2005-1476). The Mozilla Suite and Firefox also fail to verify the IconURL parameter of the InstallTrigger.install() function (CVE-2005-1477). Michael Krax and Georgi Guninski discovered that it is possible to bypass JavaScript-injection security checks by wrapping the javascript: URL within the view-source: or jar: pseudo-protocols (MFSA2005-43). Versions less than 1.0.4 are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/38418/glsa-200505-11.txt
Source: https://packetstormsecurity.com/files/38418/Gentoo-Linux-Security-Advisory-200505-11.html