Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site scripting (XSS) attacks or phishing attacks by leveraging control over navigation timing.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xulrunnerUpgrade xulrunner-develUpgrade thunderbirdUpgrade firefox | Dec 1, 2016 | Apr 3, 2013 |
| Freebsd | — | Upgrade linux-firefoxUpgrade seamonkeyUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade linux-thunderbird | Dec 10, 2025 | Apr 3, 2013 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey.Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade www-client/seamonkey-bin.Upgrade mail-client/thunderbird. | Oct 30, 2017 | Apr 3, 2013 |
| Mfsa2013 38 | — | Upgrade to Mozilla Firefox ESR version 17.0.5Upgrade to Mozilla Firefox version 20.0Upgrade to the latest version of Mozilla Firefox | Apr 3, 2013 | Apr 2, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.17.0 | Apr 3, 2013 | Apr 2, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird ESR version 17.0.5Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 17.0.5 | Apr 3, 2013 | Apr 2, 2013 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade xulrunnerUpgrade xulrunner-devel | Oct 16, 2024 | Apr 3, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 2, 2013 |
| Suse | — | Upgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade mozilla-nss-certsUpgrade seamonkey-debugsourceUpgrade mozilla-nsprUpgrade libfreebl3-x86Upgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-debuginfoUpgrade libfreebl3-debuginfo-x86Upgrade xulrunner-devel-debuginfoUpgrade seamonkey-dom-inspectorUpgrade mozilla-nspr-debuginfo-x86Upgrade mozilla-nspr-debuginfo-32bitUpgrade MozillaThunderbird-buildsymbolsUpgrade libsoftokn3-debuginfo-32bitUpgrade MozillaThunderbird-devel-debuginfoUpgrade mozilla-nss-sysinit-x86Upgrade mozillafirefox-branding-upstreamUpgrade xulrunner-debuginfoUpgrade MozillaThunderbirdUpgrade libfreebl3-debuginfo-32bitUpgrade MozillaThunderbird-debuginfoUpgrade mozilla-nss-sysinitUpgrade xulrunner-32bitUpgrade enigmail-debuginfoUpgrade xulrunner-debugsourceUpgrade MozillaThunderbird-develUpgrade libsoftokn3-x86Upgrade seamonkeyUpgrade MozillaFirefox-develUpgrade seamonkey-debuginfoUpgrade xulrunner-x86Upgrade mozilla-nspr-debuginfoUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nssUpgrade mozilla-nss-debugsourceUpgrade libfreebl3Upgrade xulrunnerUpgrade xulrunner-buildsymbolsUpgrade mozilla-js-debuginfo-32bitUpgrade libsoftokn3-debuginfoUpgrade mozilla-nss-sysinit-32bitUpgrade MozillaFirefox-debugsourceUpgrade mozilla-nspr-32bitUpgrade seamonkey-venkmanUpgrade mozilla-nss-debuginfo-x86Upgrade libsoftokn3-debuginfo-x86Upgrade mozilla-nspr-debugsourceUpgrade libfreebl3-debuginfoUpgrade mozilla-nss-tools-debuginfoUpgrade mozilla-nss-x86Upgrade mozilla-nss-certs-x86Upgrade xulrunner-debuginfo-32bitUpgrade mozilla-nss-debuginfoUpgrade seamonkey-ircUpgrade mozilla-nspr-develUpgrade mozilla-nss-sysinit-debuginfo-x86Upgrade xulrunner-debuginfo-x86Upgrade mozilla-nss-sysinit-debuginfoUpgrade enigmailUpgrade libsoftokn3Upgrade mozilla-js-debuginfo-x86Upgrade mozilla-nss-develUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translations-commonUpgrade libsoftokn3-32bitUpgrade mozilla-nss-certs-debuginfo-32bitUpgrade mozilla-nss-32bitUpgrade MozillaFirefoxUpgrade mozilla-nss-toolsUpgrade mozilla-js-32bitUpgrade seamonkey-translations-commonUpgrade xulrunner-develUpgrade mozilla-nss-debuginfo-32bitUpgrade mozilla-jsUpgrade mozilla-js-x86Upgrade mozilla-nss-certs-debuginfo-x86Upgrade MozillaThunderbird-translations-commonUpgrade mozilla-nspr-x86Upgrade MozillaThunderbird-debugsourceUpgrade MozillaFirefox-translations-otherUpgrade mozilla-js-debuginfoUpgrade mozilla-nss-certs-debuginfoUpgrade mozillafirefox-buildsymbolsUpgrade MozillaFirefox-translationsUpgrade seamonkey-translations-other | Feb 17, 2015 | Apr 3, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 8, 2024 | Apr 3, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub