The importScripts Web Worker method in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not verify that content is valid JavaScript code, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted HTML document.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade xulrunnerUpgrade xulrunner-devel | Dec 1, 2016 | Jul 30, 2010 |
| Freebsd | — | Upgrade linux-firefox-develUpgrade linux-firefoxUpgrade firefoxUpgrade seamonkeyUpgrade thunderbird | Dec 10, 2025 | Jul 21, 2010 |
| Gentoo Linux | — | Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/thunderbird.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/mozilla-firefox.Upgrade www-client/seamonkey.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox.Upgrade net-libs/xulrunner.Upgrade www-client/firefox-bin.Upgrade www-client/icecat.Upgrade dev-libs/nss. | Oct 30, 2017 | Jul 30, 2010 |
| Mfsa2010 42 | — | Upgrade to Mozilla Firefox version 3.5.11Upgrade to Mozilla Firefox version 3.6.7 | Jun 14, 2012 | Jul 30, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.6 | Feb 3, 2012 | Jul 30, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.1Upgrade to Mozilla Thunderbird version 3.0.6 | Feb 22, 2012 | Jul 30, 2010 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade firefoxUpgrade xulrunner | Oct 16, 2024 | Jul 30, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 20, 2010 |
| Suse | — | Upgrade mozilla-nss-x86Upgrade MozillaFirefox-translations-commonUpgrade mozilla-nspr-x86Upgrade mozilla-xulrunner192Upgrade libidl-32bitUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192-develUpgrade MozillaFirefoxUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner190-translationsUpgrade libfreebl3-32bitUpgrade mozilla-nsprUpgrade mozilla-xulrunner192-translationsUpgrade libidlUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner191-x86Upgrade mozilla-xulrunner190-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-32bitUpgrade orbit2-32bitUpgrade mozilla-xulrunner192-x86Upgrade mozilla-nssUpgrade gconf2-32bitUpgrade orbit2Upgrade mozilla-xulrunner191-translationsUpgrade MozillaFirefox-translations-otherUpgrade mozilla-xulrunner191Upgrade mozilla-xulrunner192-translations-32bitUpgrade mozilla-nss-toolsUpgrade gconf2Upgrade gconf2-x86Upgrade orbit2-x86Upgrade libidl-x86Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-xulrunner191-gnomevfsUpgrade MozillaThunderbird-develUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbird-translations-otherUpgrade libfreebl3Upgrade libfreebl3-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner190-x86Upgrade MozillaFirefox-devel | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade thunderbirdUpgrade abrowserUpgrade firefoxUpgrade xulrunner-1.9.2Upgrade firefox-3.5Upgrade firefox-3.0 | Nov 8, 2024 | Jul 30, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub