Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an uploaded HTML document.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade yelpUpgrade totemUpgrade totem-mozpluginUpgrade firefoxUpgrade seamonkeyUpgrade xulrunnerUpgrade gnome-python2-extrasUpgrade thunderbirdUpgrade seamonkey-nspr-develUpgrade seamonkey-chatUpgrade gnome-python2-gtkhtml2Upgrade seamonkey-mailUpgrade gnome-python2-libeggUpgrade gnome-python2-gtkspellUpgrade gnome-python2-gtkmozembedUpgrade seamonkey-js-debuggerUpgrade seamonkey-dom-inspectorUpgrade totem-develUpgrade seamonkey-nssUpgrade escUpgrade devhelp-develUpgrade devhelpUpgrade seamonkey-nss-develUpgrade seamonkey-nsprUpgrade seamonkey-develUpgrade xulrunner-devel | Dec 1, 2016 | Jun 24, 2010 |
| Freebsd | — | Upgrade seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade linux-firefox-devel | Dec 10, 2025 | Jun 23, 2010 |
| Gentoo Linux | — | Upgrade www-client/seamonkey.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird.Upgrade dev-libs/nss.Upgrade www-client/mozilla-firefox.Upgrade mail-client/thunderbird-bin.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/icecat.Upgrade mail-client/mozilla-thunderbird. | Oct 30, 2017 | Jun 24, 2010 |
| Mfsa2010 32 | — | Upgrade to Mozilla Firefox version 3.6.4Upgrade to Mozilla Firefox version 3.5.10 | Jun 14, 2012 | Jun 24, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.5 | Feb 3, 2012 | Jun 24, 2010 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade gnome-python2-libeggUpgrade escUpgrade firefoxUpgrade totem-mozpluginUpgrade devhelp-develUpgrade xulrunnerUpgrade yelpUpgrade gnome-python2-gtkhtml2Upgrade devhelpUpgrade gnome-python2-gtkspellUpgrade totem-develUpgrade totemUpgrade gnome-python2-gtkmozembedUpgrade gnome-python2-extras | Oct 16, 2024 | Jun 23, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 22, 2010 |
| Suse | — | Upgrade MozillaFirefoxUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner191-x86Upgrade orbit2Upgrade mozilla-nss-x86Upgrade mozilla-xulrunner191-32bitUpgrade libidlUpgrade libidl-32bitUpgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192Upgrade mozilla-xulrunner192-develUpgrade mozilla-nspr-x86Upgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-nsprUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner190-translationsUpgrade libfreebl3Upgrade MozillaFirefox-translationsUpgrade libfreebl3-32bitUpgrade MozillaFirefox-develUpgrade mozilla-nss-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade orbit2-32bitUpgrade mozilla-nssUpgrade mozilla-xulrunner191-gnomevfsUpgrade libfreebl3-x86Upgrade gconf2-32bitUpgrade libidl-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner190-x86Upgrade mozilla-xulrunner191-translationsUpgrade gconf2Upgrade mozilla-xulrunner192-x86Upgrade orbit2-x86Upgrade mozilla-nss-toolsUpgrade gconf2-x86Upgrade mozilla-xulrunner191Upgrade mozilla-xulrunner192-translations-32bitUpgrade MozillaFirefox-translations-other | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade firefox-3.0Upgrade firefox-3.5Upgrade xulrunner-1.9.2Upgrade abrowserUpgrade firefox | Nov 8, 2024 | Jun 24, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub