Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade seamonkey-nspr-develUpgrade nssUpgrade seamonkey-nsprUpgrade xulrunnerUpgrade nss-toolsUpgrade nss-develUpgrade seamonkey-nssUpgrade thunderbirdUpgrade seamonkey-chatUpgrade nss-pkcs11-develUpgrade seamonkey-nss-develUpgrade seamonkey-js-debuggerUpgrade seamonkey-mailUpgrade xulrunner-devel-unstableUpgrade yelpUpgrade seamonkey-dom-inspectorUpgrade xulrunner-develUpgrade devhelpUpgrade seamonkeyUpgrade seamonkey-develUpgrade devhelp-devel | Dec 1, 2016 | Nov 13, 2008 |
| Freebsd | — | Upgrade seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade linux-thunderbird | Dec 10, 2025 | Nov 13, 2008 |
| Gentoo Linux | — | Upgrade dev-libs/nss.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade net-libs/xulrunner-bin.Upgrade www-client/mozilla-firefox.Upgrade net-libs/xulrunner.Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/icecat.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Nov 13, 2008 |
| Mfsa2008 58 | — | Upgrade to Mozilla Firefox version 2.0.0.18Upgrade to Mozilla Firefox version 3.0.4 | Jun 14, 2012 | Nov 13, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.13 | Feb 3, 2012 | Nov 13, 2008 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 2.0.0.18 | Feb 22, 2012 | Nov 13, 2008 |
| Oracle_linux | — | Upgrade xulrunnerUpgrade xulrunner-develUpgrade devhelp-develUpgrade nssUpgrade xulrunner-devel-unstableUpgrade nss-toolsUpgrade devhelpUpgrade yelpUpgrade nss-pkcs11-develUpgrade firefoxUpgrade nss-devel | Oct 16, 2024 | Nov 13, 2008 |
| Suse | — | Upgrade mozilla-xulrunner190-64bitUpgrade mozilla-xulrunner190Upgrade suse-releaseUpgrade mozilla-huUpgrade seamonkey-ircUpgrade mozilla-calendarUpgrade mozilla-xulrunner190-translations-64bitUpgrade MozillaFirefox-translationsUpgrade epiphany-extensionsUpgrade mozillaUpgrade mozilla-xulrunner181-32bitUpgrade gecko-sdkUpgrade epiphany-develUpgrade mozilla-venkmanUpgrade epiphany-docUpgrade MozillaThunderbird-develUpgrade MozillaFirefoxUpgrade mozilla-develUpgrade mozilla-dom-inspectorUpgrade MozillaThunderbird-translationsUpgrade mozilla-xulrunner190-translations-32bitUpgrade mozilla-xulrunner190-translationsUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner181Upgrade seamonkey-venkmanUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner190-develUpgrade seamonkey-spellcheckerUpgrade mozilla-xulrunner181-l10nUpgrade mozilla-deatUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade mozilla-xulrunner181-64bitUpgrade mozilla-ircUpgrade mozilla-xulrunner181-develUpgrade mozilla-mailUpgrade seamonkey-mailUpgrade epiphanyUpgrade mozilla-csUpgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade seamonkeyUpgrade seamonkey-dom-inspector | Feb 17, 2015 | Nov 13, 2008 |
| Ubuntu | — | Upgrade firefoxUpgrade mozilla-thunderbirdUpgrade thunderbirdUpgrade abrowserUpgrade firefox-3.0Upgrade xulrunner-1.9 | Nov 8, 2024 | Nov 13, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub