Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4 and SeaMonkey before 2.0.5 does not properly handle situations in which both \Content-Disposition: attachment\ and \Content-Type: multipart\ are present in HTTP headers which allows remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.