Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade seamonkey-mailUpgrade devhelp-develUpgrade seamonkey-develUpgrade seamonkeyUpgrade seamonkey-js-debuggerUpgrade seamonkey-dom-inspectorUpgrade devhelpUpgrade seamonkey-chatUpgrade firefoxUpgrade thunderbird | Dec 1, 2016 | Sep 24, 2008 |
| Freebsd | — | Upgrade linux-seamonkeyUpgrade linux-flockUpgrade linux-thunderbirdUpgrade linux-firefox-develUpgrade firefoxUpgrade thunderbirdUpgrade linux-firefoxUpgrade seamonkeyUpgrade flockUpgrade linux-seamonkey-devel | Dec 10, 2025 | Sep 24, 2008 |
| Gentoo Linux | — | Upgrade www-client/icecat.Upgrade www-client/mozilla-firefox-bin.Upgrade dev-libs/nss.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird.Upgrade net-libs/xulrunner-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Sep 24, 2008 |
| Mfsa2008 43 | — | Upgrade to Mozilla Firefox version 2.0.0.17Upgrade to Mozilla Firefox version 3.0.2 | Jun 14, 2012 | Sep 24, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.12 | Feb 3, 2012 | Sep 24, 2008 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 2.0.0.17 | Feb 22, 2012 | Sep 24, 2008 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade nssUpgrade xulrunnerUpgrade nss-toolsUpgrade xulrunner-devel-unstableUpgrade nss-pkcs11-develUpgrade devhelpUpgrade yelpUpgrade devhelp-develUpgrade nss-develUpgrade firefox | Oct 16, 2024 | Sep 24, 2008 |
| Suse | — | Upgrade seamonkey-venkmanUpgrade mozilla-mailUpgrade mozilla-huUpgrade mozilla-calendarUpgrade mozilla-dom-inspectorUpgrade MozillaThunderbird-develUpgrade mozillaUpgrade mozilla-csUpgrade mozilla-xulrunner181-64bitUpgrade mozilla-xulrunner181Upgrade mozilla-xulrunner190-translations-64bitUpgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade mozilla-xulrunner181-32bitUpgrade seamonkey-mailUpgrade seamonkey-spellcheckerUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner190-translations-32bitUpgrade mozilla-venkmanUpgrade suse-releaseUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade mozilla-xulrunner181-l10nUpgrade MozillaThunderbird-translationsUpgrade mozilla-xulrunner190-develUpgrade mozilla-deatUpgrade mozilla-xulrunner190Upgrade mozilla-develUpgrade mozilla-xulrunner181-develUpgrade mozilla-xulrunner190-32bitUpgrade seamonkeyUpgrade MozillaFirefox-translationsUpgrade seamonkey-dom-inspectorUpgrade mozilla-xulrunner190-64bitUpgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-ircUpgrade seamonkey-ircUpgrade mozilla-xulrunner190-translationsUpgrade gecko-sdkUpgrade MozillaFirefox | Feb 17, 2015 | Sep 24, 2008 |
| Ubuntu | — | Upgrade mozilla-thunderbirdUpgrade thunderbirdUpgrade firefoxUpgrade xulrunner-1.9Upgrade firefox-3.0 | Nov 8, 2024 | Sep 24, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub