jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade seamonkey-nss-develUpgrade nss-pkcs11-develUpgrade seamonkey-nssUpgrade seamonkey-mailUpgrade xulrunnerUpgrade seamonkey-develUpgrade nssUpgrade seamonkey-nsprUpgrade seamonkey-nspr-develUpgrade xulrunner-devel-unstableUpgrade seamonkey-js-debuggerUpgrade yelpUpgrade nss-develUpgrade firefoxUpgrade seamonkey-dom-inspectorUpgrade nss-toolsUpgrade devhelp-develUpgrade seamonkey-chatUpgrade thunderbirdUpgrade seamonkeyUpgrade xulrunner-develUpgrade devhelp | Dec 1, 2016 | Nov 13, 2008 |
| Freebsd | — | Upgrade seamonkeyUpgrade firefoxUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade linux-thunderbird | Dec 10, 2025 | Nov 13, 2008 |
| Gentoo Linux | — | Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade net-libs/xulrunner.Upgrade dev-libs/nss.Upgrade www-client/seamonkey-bin.Upgrade www-client/icecat.Upgrade www-client/mozilla-firefox.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/seamonkey.Upgrade www-client/firefox. | Oct 30, 2017 | Nov 13, 2008 |
| Mfsa2008 50 | — | Upgrade to Mozilla Firefox version 3.0.2Upgrade to Mozilla Firefox version 2.0.0.18 | Jun 14, 2012 | Nov 13, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.13 | Feb 3, 2012 | Nov 13, 2008 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 2.0.0.18 | Feb 22, 2012 | Nov 13, 2008 |
| Oracle_linux | — | Upgrade xulrunner-devel-unstableUpgrade devhelp-develUpgrade xulrunner-develUpgrade xulrunnerUpgrade nssUpgrade nss-toolsUpgrade nss-develUpgrade nss-pkcs11-develUpgrade yelpUpgrade devhelpUpgrade firefox | Oct 16, 2024 | Nov 13, 2008 |
| Suse | — | Upgrade mozilla-xulrunner190-translations-64bitUpgrade epiphany-docUpgrade mozilla-xulrunner181-32bitUpgrade epiphany-develUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade mozillaUpgrade MozillaThunderbird-develUpgrade mozilla-xulrunner181-l10nUpgrade epiphanyUpgrade mozilla-xulrunner190-64bitUpgrade mozilla-huUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-calendarUpgrade seamonkey-mailUpgrade suse-releaseUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner190-translations-32bitUpgrade mozilla-xulrunner181Upgrade seamonkey-ircUpgrade gecko-sdkUpgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner181-64bitUpgrade mozilla-xulrunner181-develUpgrade seamonkey-venkmanUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner190-gnomevfsUpgrade seamonkey-spellcheckerUpgrade MozillaFirefoxUpgrade seamonkeyUpgrade mozilla-dom-inspectorUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade mozilla-csUpgrade mozilla-venkmanUpgrade mozilla-xulrunner190-develUpgrade mozilla-ircUpgrade mozilla-mailUpgrade mozilla-develUpgrade MozillaThunderbird-translationsUpgrade seamonkey-dom-inspectorUpgrade mozilla-deatUpgrade epiphany-extensions | Feb 17, 2015 | Nov 13, 2008 |
| Ubuntu | — | Upgrade thunderbirdUpgrade xulrunner-1.9Upgrade firefoxUpgrade mozilla-thunderbirdUpgrade abrowserUpgrade firefox-3.0 | Nov 8, 2024 | Nov 13, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub