Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads to a concurrency failure that causes structures to be freed incorrectly, as demonstrated by (1) ffoxdie and (2) ffoxdie3. NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie. Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability. NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade thunderbird | Jul 30, 2024 | Aug 21, 2006 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade linux-mozillaUpgrade firefoxUpgrade linux-firefox-develUpgrade mozillaUpgrade linux-seamonkeyUpgrade linux-seamonkey-develUpgrade thunderbirdUpgrade linux-mozilla-develUpgrade seamonkeyUpgrade mozilla-thunderbirdUpgrade linux-firefox | Dec 10, 2025 | Sep 15, 2006 |
| Gentoo Linux | — | Upgrade www-client/seamonkey.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade mail-client/mozilla-thunderbird. | Oct 30, 2017 | Aug 21, 2006 |
| Mfsa2006 59 | — | Upgrade to Mozilla Firefox version 1.5.0.7 | Jun 14, 2012 | Aug 21, 2006 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.0.5 | Feb 3, 2012 | Aug 21, 2006 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 1.5.0.7 | Feb 22, 2012 | Aug 21, 2006 |
| Ubuntu | — | Upgrade mozilla-thunderbird-inspectorUpgrade mozilla-thunderbird-locale-itUpgrade mozilla-thunderbird-locale-plUpgrade mozilla-thunderbirdUpgrade firefoxUpgrade mozilla-thunderbird-locale-deUpgrade mozilla-thunderbird-typeaheadfindUpgrade mozilla-thunderbird-locale-ukUpgrade mozilla-thunderbird-locale-nlUpgrade mozilla-thunderbird-locale-caUpgrade mozilla-thunderbird-enigmailUpgrade mozilla-thunderbird-locale-frUpgrade libnss3 | Nov 8, 2024 | Aug 21, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub