Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunnerUpgrade xulrunner-devel-unstableUpgrade seamonkeyUpgrade seamonkey-develUpgrade seamonkey-js-debuggerUpgrade xulrunner-develUpgrade seamonkey-chatUpgrade seamonkey-dom-inspectorUpgrade seamonkey-mailUpgrade firefox | Dec 1, 2016 | Dec 17, 2009 |
| Freebsd | — | Upgrade linux-firefoxUpgrade linux-seamonkeyUpgrade firefoxUpgrade seamonkeyUpgrade thunderbird | Dec 10, 2025 | Dec 16, 2009 |
| Gentoo Linux | — | Upgrade www-client/icecat.Upgrade www-client/seamonkey.Upgrade www-client/mozilla-firefox.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade net-libs/xulrunner.Upgrade dev-libs/nss.Upgrade www-client/firefox.Upgrade www-client/seamonkey-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/firefox-bin.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/mozilla-firefox-bin. | Oct 30, 2017 | Dec 17, 2009 |
| Mfsa2009 69 | — | Upgrade to Mozilla Firefox version 3.5.6Upgrade to Mozilla Firefox version 3.0.16 | Jun 14, 2012 | Dec 17, 2009 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.1 | Feb 3, 2012 | Dec 17, 2009 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade xulrunner-devel-unstableUpgrade xulrunnerUpgrade firefox | Oct 16, 2024 | Dec 17, 2009 |
| Suse | — | Upgrade libfreebl3-32bitUpgrade mozilla-xulrunner192-x86Upgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-nss-x86Upgrade orbit2-32bitUpgrade mozilla-xulrunner190-gnomevfsUpgrade gconf2-x86Upgrade libfreebl3Upgrade orbit2-x86Upgrade gconf2Upgrade libfreebl3-x86Upgrade mozilla-xulrunner192Upgrade MozillaFirefox-branding-SLEDUpgrade MozillaFirefox-translations-otherUpgrade gconf2-32bitUpgrade libidl-x86Upgrade mozilla-nssUpgrade mozilla-nss-32bitUpgrade mozilla-xulrunner190-x86Upgrade MozillaFirefox-develUpgrade libidl-32bitUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner191-gnomevfsUpgrade MozillaFirefox-translationsUpgrade mozilla-nspr-32bitUpgrade MozillaFirefoxUpgrade mozilla-xulrunner191Upgrade mozilla-xulrunner192-32bitUpgrade orbit2Upgrade mozilla-nss-toolsUpgrade libidlUpgrade mozilla-xulrunner191-x86Upgrade mozilla-nsprUpgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-nspr-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade xulrunner-1.9Upgrade firefox-3.5Upgrade firefox-3.0Upgrade xulrunner-1.9.1Upgrade abrowser | Nov 8, 2024 | Dec 17, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub