dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler.
CVSS Details
- CVSS 3.1 Base Score: 5.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade seamonkey-develUpgrade seamonkey-js-debuggerUpgrade seamonkeyUpgrade seamonkey-mailUpgrade thunderbirdUpgrade seamonkey-nss-develUpgrade xulrunner-develUpgrade seamonkey-chatUpgrade xulrunnerUpgrade seamonkey-dom-inspectorUpgrade seamonkey-nspr-develUpgrade seamonkey-nsprUpgrade seamonkey-nssUpgrade firefox | Dec 1, 2016 | Jul 30, 2010 |
| Freebsd | — | Upgrade seamonkeyUpgrade firefoxUpgrade linux-firefoxUpgrade thunderbirdUpgrade linux-firefox-devel | Dec 10, 2025 | Jul 21, 2010 |
| Gentoo Linux | — | Upgrade www-client/seamonkey.Upgrade net-libs/xulrunner-bin.Upgrade www-client/firefox.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/icecat.Upgrade net-libs/xulrunner.Upgrade mail-client/thunderbird-bin.Upgrade dev-libs/nss.Upgrade www-client/mozilla-firefox-bin. | Oct 30, 2017 | Jul 30, 2010 |
| Mfsa2010 47 | — | Upgrade to Mozilla Firefox version 3.6.7Upgrade to Mozilla Firefox version 3.5.11 | Jun 14, 2012 | Jul 30, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.6 | Feb 3, 2012 | Jul 30, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.0.6Upgrade to Mozilla Thunderbird version 3.1.1 | Feb 22, 2012 | Jul 30, 2010 |
| Oracle_linux | — | Upgrade xulrunnerUpgrade firefoxUpgrade xulrunner-devel | Oct 16, 2024 | Jul 29, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 20, 2010 |
| Suse | — | Upgrade mozilla-xulrunner192-x86Upgrade mozilla-nss-x86Upgrade mozilla-xulrunner192-translations-32bitUpgrade libfreebl3-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-xulrunner190-x86Upgrade orbit2-x86Upgrade MozillaFirefox-translations-otherUpgrade libidl-x86Upgrade mozilla-nspr-x86Upgrade mozilla-xulrunner191Upgrade mozilla-nss-toolsUpgrade gconf2Upgrade libidlUpgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-nssUpgrade MozillaThunderbird-develUpgrade orbit2-32bitUpgrade gconf2-32bitUpgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade gconf2-x86Upgrade libfreebl3Upgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-branding-SLEDUpgrade MozillaFirefoxUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner192-develUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner191-x86Upgrade mozilla-nsprUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192Upgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner190-32bitUpgrade orbit2Upgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner192-translationsUpgrade MozillaThunderbirdUpgrade libidl-32bitUpgrade MozillaThunderbird-translations-other | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade xulrunner-1.9.2Upgrade thunderbirdUpgrade firefoxUpgrade firefox-3.0Upgrade abrowserUpgrade firefox-3.5 | Nov 8, 2024 | Jul 30, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub