Integer overflow in the FRAMESET element implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via a large number of values in the cols (aka columns) attribute, leading to a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nss-develUpgrade seamonkey-nss-develUpgrade seamonkey-chatUpgrade seamonkey-nspr-develUpgrade xulrunnerUpgrade nssUpgrade xulrunner-develUpgrade seamonkey-nsprUpgrade seamonkey-js-debuggerUpgrade seamonkey-develUpgrade nspr-develUpgrade thunderbirdUpgrade nss-toolsUpgrade seamonkey-mailUpgrade nsprUpgrade seamonkey-dom-inspectorUpgrade firefoxUpgrade seamonkeyUpgrade nss-pkcs11-develUpgrade seamonkey-nss | Dec 1, 2016 | Sep 9, 2010 |
| Freebsd | — | Upgrade libxulUpgrade linux-firefoxUpgrade seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade linux-firefox-devel | Dec 10, 2025 | Sep 8, 2010 |
| Gentoo Linux | — | Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey-bin.Upgrade dev-libs/nss.Upgrade net-libs/xulrunner.Upgrade www-client/firefox.Upgrade www-client/icecat.Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird-bin.Upgrade www-client/mozilla-firefox-bin. | Oct 30, 2017 | Sep 9, 2010 |
| Mfsa2010 50 | — | Upgrade to Mozilla Firefox version 3.6.9Upgrade to Mozilla Firefox version 3.5.12 | Jun 14, 2012 | Sep 9, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.7 | Feb 3, 2012 | Sep 9, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.3Upgrade to Mozilla Thunderbird version 3.0.7 | Feb 22, 2012 | Sep 9, 2010 |
| Oracle_linux | — | Upgrade nsprUpgrade xulrunner-develUpgrade nspr-develUpgrade firefoxUpgrade nss-toolsUpgrade nss-pkcs11-develUpgrade nssUpgrade nss-develUpgrade xulrunner | Oct 16, 2024 | Sep 9, 2010 |
| Suse | — | Upgrade mozilla-xulrunner191-gnomevfsUpgrade libidl-32bitUpgrade mozilla-nssUpgrade orbit2-x86Upgrade mozilla-xulrunner192-x86Upgrade mozilla-xulrunner190-x86Upgrade libidl-x86Upgrade libfreebl3Upgrade gconf2-32bitUpgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner192-develUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner190-32bitUpgrade MozillaThunderbird-translations-commonUpgrade mozilla-nsprUpgrade mozilla-xulrunner192Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-xulrunner192-translations-32bitUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-nss-32bitUpgrade mozilla-xulrunner190-gnomevfsUpgrade libfreebl3-32bitUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-nss-x86Upgrade libfreebl3-x86Upgrade libidlUpgrade mozilla-nss-toolsUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner191Upgrade MozillaFirefoxUpgrade gconf2Upgrade mozilla-nspr-x86Upgrade mozilla-xulrunner190-translationsUpgrade gconf2-x86Upgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade orbit2Upgrade MozillaFirefox-translationsUpgrade mozilla-nspr-32bitUpgrade orbit2-32bitUpgrade mozilla-xulrunner191-x86Upgrade mozilla-xulrunner192-translationsUpgrade MozillaThunderbird-develUpgrade MozillaFirefox-translations-other | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade firefox-3.0Upgrade xulrunner-1.9.1Upgrade thunderbirdUpgrade firefox-3.5Upgrade abrowserUpgrade firefoxUpgrade xulrunner-1.9.2 | Nov 8, 2024 | Sep 9, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub