The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
CVSS Details
- CVSS 3.1 Base Score: 5.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade totemUpgrade xulrunner-develUpgrade totem-mozpluginUpgrade gnome-python2-gtkhtml2Upgrade gnome-python2-libeggUpgrade firefoxUpgrade devhelp-develUpgrade xulrunnerUpgrade gnome-python2-gtkmozembedUpgrade escUpgrade totem-develUpgrade yelpUpgrade devhelpUpgrade gnome-python2-gtkspellUpgrade gnome-python2-extras | Dec 1, 2016 | Jan 20, 2009 |
| Freebsd | — | Upgrade seamonkeyUpgrade firefoxUpgrade thunderbirdUpgrade linux-firefox-devel | Dec 10, 2025 | Jun 23, 2010 |
| Gentoo Linux | — | Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade net-libs/xulrunner-bin.Upgrade www-client/firefox-bin.Upgrade www-client/icecat.Upgrade net-libs/xulrunner.Upgrade www-client/seamonkey-bin.Upgrade www-client/seamonkey.Upgrade dev-libs/nss.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/mozilla-firefox.Upgrade www-client/firefox. | Oct 30, 2017 | Jan 20, 2009 |
| Mfsa2010 33 | — | Upgrade to Mozilla Firefox version 3.5.12Upgrade to Mozilla Firefox version 3.6.9 | Jun 14, 2012 | Jan 20, 2009 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.5 | Feb 3, 2012 | Jan 20, 2009 |
| Oracle_linux | — | Upgrade gnome-python2-libeggUpgrade devhelp-develUpgrade yelpUpgrade totem-develUpgrade escUpgrade gnome-python2-gtkmozembedUpgrade devhelpUpgrade xulrunner-develUpgrade totem-mozpluginUpgrade totemUpgrade gnome-python2-gtkspellUpgrade gnome-python2-gtkhtml2Upgrade gnome-python2-extrasUpgrade firefoxUpgrade xulrunner | Oct 16, 2024 | Jan 20, 2009 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 13, 2009 |
| Suse | — | Upgrade mozilla-xulrunner192-translations-32bitUpgrade mozilla-xulrunner192-x86Upgrade MozillaFirefox-develUpgrade orbit2-32bitUpgrade mozilla-xulrunner192-develUpgrade gconf2-32bitUpgrade mozilla-nssUpgrade libfreebl3Upgrade mozilla-xulrunner191-translationsUpgrade MozillaFirefox-branding-SLEDUpgrade orbit2-x86Upgrade MozillaFirefox-translations-otherUpgrade gconf2Upgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner190-x86Upgrade libfreebl3-x86Upgrade mozilla-xulrunner192Upgrade mozilla-xulrunner190-gnomevfsUpgrade libidl-x86Upgrade orbit2Upgrade gconf2-x86Upgrade libidlUpgrade mozilla-nss-x86Upgrade mozilla-xulrunner190-translationsUpgrade MozillaFirefox-translationsUpgrade mozilla-nss-toolsUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner192-translationsUpgrade libidl-32bitUpgrade mozilla-xulrunner191-x86Upgrade MozillaFirefoxUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-nspr-x86Upgrade mozilla-nss-32bitUpgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner191Upgrade mozilla-nsprUpgrade mozilla-nspr-32bit | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade firefox-3.5Upgrade abrowserUpgrade firefoxUpgrade xulrunner-1.9.2Upgrade firefox-3.0 | Nov 8, 2024 | Jan 20, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub