Mozilla Firefox before 26.0 and SeaMonkey before 2.23 do not properly consider the sandbox attribute of an IFRAME element during processing of a contained OBJECT element, which allows remote attackers to bypass intended sandbox restrictions via a crafted web site.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade thunderbird | Dec 1, 2016 | Dec 11, 2013 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade linux-firefoxUpgrade firefoxUpgrade thunderbirdUpgrade linux-seamonkeyUpgrade seamonkey | Dec 10, 2025 | Dec 14, 2013 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/seamonkey-bin.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey.Upgrade www-client/firefox-bin.Upgrade dev-libs/nspr.Upgrade mail-client/thunderbird-bin. | Oct 30, 2017 | Dec 11, 2013 |
| Mfsa2013 107 | — | Upgrade to Mozilla Firefox version 26.0Upgrade to the latest version of Mozilla Firefox | Dec 12, 2013 | Dec 10, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.23.0 | Dec 8, 2014 | Dec 11, 2013 |
| Oracle Solaris | — | Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Dec 11, 2013 |
| Oracle_linux | — | Upgrade firefox | Oct 16, 2024 | Dec 11, 2013 |
| Suse | — | Upgrade firefox-glib2Upgrade libfreebl3-x86Upgrade mozilla-xulrunner192-translationsUpgrade firefox-atkUpgrade libfreebl3-32bitUpgrade mozilla-nss-x86Upgrade firefox-pixman-32bitUpgrade MozillaFirefox-translations-otherUpgrade sle-sdk-releaseUpgrade mozilla-xulrunner191-translations-32bitUpgrade MozillaFirefoxUpgrade libsoftokn3-32bitUpgrade firefox-libstdc++6-32bitUpgrade mozilla-xulrunner191-gnomevfs-32bitUpgrade mozillafirefox-buildsymbolsUpgrade mozilla-xulrunner191Upgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-nss-toolsUpgrade MozillaFirefox-develUpgrade firefox-freetype2Upgrade MozillaFirefox-translations-commonUpgrade mozilla-nspr-develUpgrade firefox-fontconfig-32bitUpgrade mozilla-xulrunner192-gnome-32bitUpgrade seamonkey-translations-otherUpgrade libsoftokn3Upgrade mozillafirefox-branding-upstreamUpgrade seamonkey-ircUpgrade firefox-libstdc++6Upgrade firefox-atk-32bitUpgrade mozilla-xulrunner192-32bitUpgrade firefox-freetype2-32bitUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-nss-develUpgrade seamonkey-dom-inspectorUpgrade firefox-libgcc_s1Upgrade firefox-cairo-32bitUpgrade mozilla-xulrunner192-translations-32bitUpgrade firefox-fontconfigUpgrade libsoftokn3-x86Upgrade libfreebl3Upgrade seamonkeyUpgrade firefox-gtk2-langUpgrade firefox-gtk2Upgrade firefox-pango-32bitUpgrade mozilla-nssUpgrade mozilla-nsprUpgrade firefox-pixmanUpgrade firefox-pangoUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-pcreUpgrade mozilla-xulrunner192Upgrade firefox-glib2-32bitUpgrade firefox-cairoUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner191-32bitUpgrade seamonkey-venkmanUpgrade firefox-gtk2-32bitUpgrade firefox-libgcc_s1-32bitUpgrade firefox-pcre-32bitUpgrade seamonkey-translations-commonUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-nss-32bit | Feb 17, 2015 | Dec 11, 2013 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Dec 11, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub