Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to spoof the address bar via vectors involving authentication information in the userinfo field of a URL, in conjunction with a 204 (aka No Content) HTTP status code.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunnerUpgrade xulrunner-develUpgrade thunderbirdUpgrade firefox | Dec 1, 2016 | Jan 13, 2013 |
| Freebsd | — | Upgrade ca_root_nssUpgrade libxulUpgrade linux-firefoxUpgrade seamonkeyUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade thunderbirdUpgrade firefox | Dec 10, 2025 | Jan 9, 2013 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Jan 13, 2013 |
| Mfsa2013 04 | — | Upgrade to Mozilla Firefox ESR version 17.0.2Upgrade to Mozilla Firefox ESR version 10.0.12Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 18.0 | Jan 14, 2013 | Jan 13, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.15.0 | Jan 10, 2013 | Jan 8, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird ESR version 10.0.12Upgrade to Mozilla Thunderbird ESR version 17.0.2Upgrade to Mozilla Thunderbird version 17.0.2Upgrade to the latest version of Mozilla Thunderbird | Jan 10, 2013 | Jan 8, 2013 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade xulrunnerUpgrade xulrunner-devel | Oct 16, 2024 | Jan 13, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 8, 2013 |
| Suse | — | Upgrade xulrunner-develUpgrade enigmailUpgrade mozilla-js-x86Upgrade libsoftokn3-32bitUpgrade xulrunner-debuginfo-x86Upgrade MozillaThunderbird-develUpgrade libfreebl3-debuginfo-x86Upgrade libfreebl3-debuginfoUpgrade mozilla-nss-sysinit-x86Upgrade mozilla-nss-develUpgrade mozilla-nss-32bitUpgrade MozillaThunderbird-debugsourceUpgrade mozilla-nss-certs-debuginfo-x86Upgrade seamonkey-translations-otherUpgrade mozilla-nss-certs-debuginfoUpgrade xulrunnerUpgrade mozilla-js-32bitUpgrade MozillaFirefoxUpgrade mozillafirefox-buildsymbolsUpgrade mozilla-nss-x86Upgrade mozilla-nss-certs-debuginfo-32bitUpgrade enigmail-debuginfoUpgrade mozilla-nss-certs-32bitUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-sysinit-debuginfoUpgrade xulrunner-debuginfoUpgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-translations-otherUpgrade xulrunner-debugsourceUpgrade MozillaThunderbird-translations-commonUpgrade mozilla-js-debuginfoUpgrade libsoftokn3-debuginfo-x86Upgrade libsoftokn3Upgrade mozilla-nss-debuginfoUpgrade xulrunner-debuginfo-32bitUpgrade seamonkey-ircUpgrade mozilla-nspr-develUpgrade mozilla-nss-tools-debuginfoUpgrade firefox3-gtk2-32bitUpgrade mozilla-nss-sysinit-debuginfo-x86Upgrade mozilla-js-debuginfo-32bitUpgrade sle-sdk-releaseUpgrade mozilla-nss-certs-x86Upgrade mozilla-nss-toolsUpgrade MozillaThunderbird-devel-debuginfoUpgrade firefox3-cairoUpgrade mozilla-nss-debugsourceUpgrade MozillaThunderbirdUpgrade mozilla-nss-certsUpgrade xulrunner-x86Upgrade libfreebl3-x86Upgrade mozilla-nspr-debugsourceUpgrade libfreebl3-debuginfo-32bitUpgrade seamonkey-translations-commonUpgrade libfreebl3-32bitUpgrade libsoftokn3-debuginfoUpgrade MozillaThunderbird-buildsymbolsUpgrade xulrunner-buildsymbolsUpgrade seamonkey-debuginfoUpgrade mozilla-nspr-32bitUpgrade firefox3-pango-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nspr-debuginfo-32bitUpgrade libsoftokn3-debuginfo-32bitUpgrade seamonkey-debugsourceUpgrade MozillaFirefox-debugsourceUpgrade mozilla-nss-sysinitUpgrade mozilla-nspr-64bitUpgrade mozilla-nspr-debuginfoUpgrade libfreebl3Upgrade mozilla-nss-debuginfo-x86Upgrade mozilla-js-debuginfo-x86Upgrade mozilla-nssUpgrade MozillaFirefox-develUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nsprUpgrade seamonkey-dom-inspectorUpgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbird-debuginfoUpgrade MozillaFirefox-debuginfoUpgrade firefox3-gtk2Upgrade mozilla-nss-debuginfo-32bitUpgrade mozilla-nspr-debuginfo-x86Upgrade seamonkeyUpgrade MozillaFirefox-translationsUpgrade firefox3-cairo-32bitUpgrade mozilla-nspr-x86Upgrade mozilla-nss-64bitUpgrade firefox3-pangoUpgrade seamonkey-venkmanUpgrade mozilla-jsUpgrade xulrunner-32bitUpgrade libsoftokn3-x86Upgrade xulrunner-devel-debuginfo | Feb 17, 2015 | Jan 13, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 8, 2024 | Jan 13, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub