Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving a mismatch for a document's principal, and (2) XPCNativeWrapper.toString, involving an incorrect __proto__ scope, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via a crafted document.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunner-develUpgrade firefoxUpgrade xulrunner-devel-unstableUpgrade thunderbirdUpgrade xulrunner | Dec 1, 2016 | Apr 22, 2009 |
| Freebsd | — | Upgrade firefoxUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade linux-seamonkey-develUpgrade seamonkeyUpgrade linux-firefox-develUpgrade linux-firefoxUpgrade linux-thunderbird | Dec 10, 2025 | Apr 22, 2009 |
| Gentoo Linux | — | Upgrade dev-libs/nss.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade www-client/mozilla-firefox.Upgrade www-client/icecat.Upgrade net-libs/xulrunner.Upgrade www-client/seamonkey-bin.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin. | Oct 30, 2017 | Apr 22, 2009 |
| Mfsa2009 19 | — | Upgrade to Mozilla Firefox version 3.0.9 | Jun 14, 2012 | Apr 22, 2009 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade firefoxUpgrade xulrunnerUpgrade xulrunner-devel-unstable | Oct 16, 2024 | Apr 22, 2009 |
| Suse | — | Upgrade gconf2-32bitUpgrade MozillaFirefox-translations-commonUpgrade gconf2Upgrade MozillaFirefox-branding-SLEDUpgrade libfreebl3-x86Upgrade mozilla-xulrunner191Upgrade mozilla-xulrunner191-gnomevfsUpgrade libidl-x86Upgrade mozilla-xulrunner190-translationsUpgrade mozilla-nssUpgrade orbit2Upgrade orbit2-x86Upgrade mozilla-xulrunner192-x86Upgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-toolsUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-nss-x86Upgrade mozilla-xulrunner190-32bitUpgrade mozilla-nspr-x86Upgrade mozilla-xulrunner192Upgrade mozilla-nsprUpgrade gconf2-x86Upgrade libfreebl3Upgrade mozilla-xulrunner192-32bitUpgrade mozilla-xulrunner190-x86Upgrade mozilla-nss-32bitUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-nspr-32bitUpgrade libidlUpgrade mozilla-xulrunner191-x86Upgrade orbit2-32bitUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192-translationsUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translationsUpgrade libidl-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade MozillaFirefoxUpgrade mozilla-xulrunner190-gnomevfs | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade abrowserUpgrade firefox-3.0Upgrade thunderbirdUpgrade xulrunner-1.9 | Nov 8, 2024 | Apr 22, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub