Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade thunderbird | Dec 1, 2016 | Apr 30, 2014 |
| Freebsd | — | Upgrade firefox-esrUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade seamonkeyUpgrade firefoxUpgrade thunderbirdUpgrade linux-firefox | Dec 10, 2025 | Apr 29, 2014 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade dev-libs/nspr.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox-bin.Upgrade www-client/firefox. | Oct 30, 2017 | Apr 30, 2014 |
| Mfsa2014 46 | — | Upgrade to Mozilla Firefox version 29.0Upgrade to Mozilla Firefox ESR version 24.5Upgrade to the latest version of Mozilla Firefox | Apr 30, 2014 | Apr 29, 2014 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.26.0 | Dec 8, 2014 | Apr 30, 2014 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 24.5Upgrade to the latest version of Mozilla Thunderbird | Apr 30, 2014 | Apr 29, 2014 |
| Oracle Solaris | — | Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.8.2-0.175.2.5.0.4.0 on Solaris 11.2Upgrade database/sqlite-3 to version 3.8.2-0.175.2.5.0.4.0 on Solaris 11.2Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3Upgrade web/browser/firefox to version 24.7.0-0.175.2.5.0.4.0 on Solaris 11.2Upgrade database/sqlite-3/documentation to version 3.8.2-0.175.2.5.0.4.0 on Solaris 11.2 | May 29, 2017 | Apr 30, 2014 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefox | Oct 16, 2024 | Apr 30, 2014 |
| Suse | — | Upgrade MozillaFirefoxUpgrade mozilla-nspr-32bitUpgrade mozilla-nsprUpgrade mozilla-nspr-develUpgrade MozillaFirefox-translations-commonUpgrade libsoftokn3-32bitUpgrade MozillaFirefox-develUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbirdUpgrade MozillaFirefox-translations-otherUpgrade libsoftokn3Upgrade MozillaFirefox-branding-SLEDUpgrade libfreebl3Upgrade mozilla-nss-toolsUpgrade mozilla-nspr-x86Upgrade libfreebl3-x86Upgrade mozilla-nssUpgrade mozilla-nss-develUpgrade libfreebl3-32bitUpgrade libsoftokn3-x86Upgrade MozillaFirefox-translationsUpgrade mozilla-nss-x86Upgrade mozilla-nss-32bitUpgrade MozillaThunderbird-develUpgrade MozillaThunderbird-translations-common | Dec 18, 2015 | Apr 30, 2014 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Nov 8, 2024 | Apr 30, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub