The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nss-develUpgrade firefoxUpgrade seamonkey-nsprUpgrade seamonkey-chatUpgrade nssUpgrade devhelpUpgrade xulrunner-devel-unstableUpgrade seamonkeyUpgrade seamonkey-js-debuggerUpgrade yelpUpgrade nss-pkcs11-develUpgrade seamonkey-mailUpgrade seamonkey-develUpgrade seamonkey-nss-develUpgrade xulrunner-develUpgrade devhelp-develUpgrade xulrunnerUpgrade seamonkey-nspr-develUpgrade seamonkey-dom-inspectorUpgrade nss-toolsUpgrade seamonkey-nss | Dec 1, 2016 | Nov 13, 2008 |
| Freebsd | — | Upgrade linux-seamonkeyUpgrade seamonkeyUpgrade linux-firefoxUpgrade linux-thunderbirdUpgrade thunderbirdUpgrade firefox | Dec 10, 2025 | Nov 13, 2008 |
| Gentoo Linux | — | Upgrade mail-client/mozilla-thunderbird-bin.Upgrade mail-client/thunderbird.Upgrade net-libs/xulrunner-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/icecat.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade mail-client/thunderbird-bin.Upgrade dev-libs/nss.Upgrade www-client/firefox-bin.Upgrade mail-client/mozilla-thunderbird. | Oct 30, 2017 | Nov 13, 2008 |
| Mfsa2008 54 | — | Upgrade to Mozilla Firefox version 3.0.4Upgrade to Mozilla Firefox version 2.0.0.18 | Jun 14, 2012 | Nov 13, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.13 | Feb 3, 2012 | Nov 13, 2008 |
| Oracle_linux | — | Upgrade devhelpUpgrade nss-pkcs11-develUpgrade nss-develUpgrade yelpUpgrade nss-toolsUpgrade nssUpgrade firefoxUpgrade xulrunnerUpgrade xulrunner-devel-unstableUpgrade devhelp-develUpgrade xulrunner-devel | Oct 16, 2024 | Nov 13, 2008 |
| Suse | — | Upgrade seamonkeyUpgrade mozilla-ircUpgrade seamonkey-ircUpgrade mozilla-venkmanUpgrade mozilla-xulrunner190-develUpgrade mozilla-xulrunner190Upgrade seamonkey-spellcheckerUpgrade mozilla-xulrunner190-translationsUpgrade MozillaFirefoxUpgrade MozillaFirefox-translationsUpgrade epiphany-extensionsUpgrade mozilla-mailUpgrade mozilla-xulrunner190-gnomevfsUpgrade seamonkey-dom-inspectorUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade mozilla-develUpgrade mozilla-xulrunner190-translations-32bitUpgrade seamonkey-mailUpgrade mozilla-calendarUpgrade mozilla-csUpgrade mozilla-xulrunner190-translations-64bitUpgrade mozilla-xulrunner181-l10nUpgrade seamonkey-venkmanUpgrade epiphany-develUpgrade gecko-sdkUpgrade mozilla-xulrunner181Upgrade mozilla-xulrunner181-64bitUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-dom-inspectorUpgrade mozilla-huUpgrade mozilla-deatUpgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade mozillaUpgrade suse-releaseUpgrade epiphany-docUpgrade epiphanyUpgrade mozilla-xulrunner181-develUpgrade mozilla-xulrunner181-32bitUpgrade mozilla-xulrunner190-64bit | Feb 17, 2015 | Nov 13, 2008 |
| Ubuntu | — | Upgrade firefoxUpgrade abrowserUpgrade xulrunner-1.9Upgrade firefox-3.0 | Nov 8, 2024 | Nov 13, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub