The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefox | Dec 1, 2016 | Apr 28, 2010 |
| Freebsd | — | Upgrade linux-seamonkeyUpgrade firefoxUpgrade seamonkeyUpgrade thunderbirdUpgrade linux-firefox-develUpgrade linux-thunderbirdUpgrade linux-firefoxUpgrade libxul | Dec 10, 2025 | Mar 1, 2011 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade net-libs/xulrunner-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox.Upgrade www-client/icecat.Upgrade dev-libs/nss.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/seamonkey. | Oct 30, 2017 | Apr 28, 2010 |
| Mfsa2011 08 | — | Upgrade to Mozilla Firefox version 3.6.14Upgrade to Mozilla Firefox version 3.5.17 | Jun 14, 2012 | Apr 28, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.12 | Feb 3, 2012 | Apr 28, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.8 | Feb 22, 2012 | Apr 28, 2010 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade firefoxUpgrade thunderbirdUpgrade xulrunner | Oct 16, 2024 | Apr 28, 2010 |
| Suse | — | Upgrade MozillaThunderbird-develUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbirdUpgrade MozillaFirefoxUpgrade mozilla-xulrunner192-32bitUpgrade MozillaThunderbird-translations-commonUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner192-translations-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner192Upgrade MozillaFirefox-develUpgrade mozilla-xulrunner192-develUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner192-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbirdUpgrade xulrunner-1.9.2Upgrade xulrunner-1.9.1 | Nov 8, 2024 | Apr 28, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub