The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunner-develUpgrade nssUpgrade nss-toolsUpgrade firefoxUpgrade nss-pkcs11-develUpgrade nsprUpgrade xulrunnerUpgrade nspr-develUpgrade nss-devel | Dec 1, 2016 | Sep 9, 2010 |
| Freebsd | — | Upgrade linux-firefoxUpgrade thunderbirdUpgrade libxulUpgrade seamonkeyUpgrade linux-firefox-develUpgrade firefox | Dec 10, 2025 | Sep 8, 2010 |
| Gentoo Linux | — | Upgrade mail-client/mozilla-thunderbird-bin.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird.Upgrade www-client/firefox-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox.Upgrade www-client/icecat.Upgrade www-client/mozilla-firefox.Upgrade net-libs/xulrunner.Upgrade mail-client/mozilla-thunderbird.Upgrade dev-libs/nss.Upgrade www-client/seamonkey. | Oct 30, 2017 | Sep 9, 2010 |
| Mfsa2010 59 | — | Upgrade to Mozilla Firefox version 3.6.9 | Jun 14, 2012 | Sep 9, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.3 | Feb 22, 2012 | Sep 9, 2010 |
| Oracle_linux | — | Upgrade nspr-develUpgrade nssUpgrade nss-develUpgrade nsprUpgrade nss-toolsUpgrade firefoxUpgrade xulrunnerUpgrade xulrunner-develUpgrade nss-pkcs11-devel | Oct 16, 2024 | Sep 9, 2010 |
| Suse | — | Upgrade MozillaFirefoxUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner190-gnomevfsUpgrade gconf2Upgrade mozilla-xulrunner190Upgrade mozilla-xulrunner192-32bitUpgrade mozilla-xulrunner190-x86Upgrade orbit2-32bitUpgrade mozilla-nss-32bitUpgrade mozilla-nss-toolsUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-x86Upgrade libidlUpgrade libfreebl3-32bitUpgrade gconf2-x86Upgrade mozilla-nspr-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-xulrunner191Upgrade mozilla-nspr-x86Upgrade mozilla-xulrunner191-gnomevfsUpgrade MozillaThunderbird-translations-otherUpgrade libidl-x86Upgrade mozilla-nsprUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nssUpgrade MozillaThunderbird-develUpgrade libfreebl3-x86Upgrade orbit2Upgrade MozillaFirefox-develUpgrade mozilla-xulrunner192Upgrade mozilla-xulrunner191-x86Upgrade mozilla-xulrunner192-develUpgrade MozillaFirefox-branding-SLEDUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-commonUpgrade mozilla-xulrunner191-32bitUpgrade orbit2-x86Upgrade libidl-32bitUpgrade libfreebl3Upgrade mozilla-xulrunner192-x86Upgrade gconf2-32bitUpgrade mozilla-xulrunner192-translations-32bitUpgrade mozilla-xulrunner190-32bit | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade firefox-3.5Upgrade firefoxUpgrade abrowserUpgrade xulrunner-1.9.2Upgrade firefox-3.0Upgrade xulrunner-1.9.1 | Nov 8, 2024 | Sep 9, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub