The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nss-pkcs11-develUpgrade seamonkey-nss-develUpgrade devhelp-develUpgrade seamonkey-nspr-develUpgrade nss-toolsUpgrade nss-develUpgrade xulrunnerUpgrade nssUpgrade seamonkey-chatUpgrade firefoxUpgrade seamonkey-dom-inspectorUpgrade seamonkey-nsprUpgrade seamonkey-nssUpgrade xulrunner-devel-unstableUpgrade seamonkeyUpgrade seamonkey-mailUpgrade seamonkey-develUpgrade xulrunner-develUpgrade seamonkey-js-debuggerUpgrade yelpUpgrade devhelp | Dec 1, 2016 | Nov 13, 2008 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade firefoxUpgrade thunderbirdUpgrade seamonkeyUpgrade linux-firefoxUpgrade linux-seamonkey | Dec 10, 2025 | Nov 13, 2008 |
| Gentoo Linux | — | Upgrade net-libs/xulrunner-bin.Upgrade www-client/seamonkey-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade mail-client/thunderbird.Upgrade www-client/icecat.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox.Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade dev-libs/nss.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/mozilla-firefox-bin. | Oct 30, 2017 | Nov 13, 2008 |
| Mfsa2008 54 | — | Upgrade to Mozilla Firefox version 2.0.0.18Upgrade to Mozilla Firefox version 3.0.4 | Jun 14, 2012 | Nov 13, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.13 | Feb 3, 2012 | Nov 13, 2008 |
| Oracle_linux | — | Upgrade yelpUpgrade firefoxUpgrade nss-develUpgrade nss-toolsUpgrade nssUpgrade nss-pkcs11-develUpgrade devhelpUpgrade xulrunnerUpgrade xulrunner-devel-unstableUpgrade xulrunner-develUpgrade devhelp-devel | Oct 16, 2024 | Nov 13, 2008 |
| Suse | — | Upgrade mozilla-xulrunner190-32bitUpgrade epiphany-docUpgrade mozilla-csUpgrade mozilla-xulrunner181-develUpgrade mozilla-deatUpgrade gecko-sdkUpgrade mozilla-xulrunner190-64bitUpgrade seamonkey-mailUpgrade mozillaUpgrade mozilla-xulrunner181-l10nUpgrade mozilla-huUpgrade mozilla-xulrunner181-32bitUpgrade mozilla-xulrunner181Upgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade epiphanyUpgrade mozilla-xulrunner190-translations-64bitUpgrade suse-releaseUpgrade mozilla-xulrunner190-translations-32bitUpgrade mozilla-dom-inspectorUpgrade epiphany-develUpgrade mozilla-calendarUpgrade seamonkey-venkmanUpgrade mozilla-xulrunner181-64bitUpgrade epiphany-extensionsUpgrade mozilla-develUpgrade mozilla-mailUpgrade mozilla-xulrunner190-translationsUpgrade seamonkey-ircUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade mozilla-venkmanUpgrade seamonkeyUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner190-gnomevfsUpgrade seamonkey-spellcheckerUpgrade MozillaFirefoxUpgrade mozilla-ircUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner190-develUpgrade seamonkey-dom-inspector | Feb 17, 2015 | Nov 13, 2008 |
| Ubuntu | — | Upgrade xulrunner-1.9Upgrade firefoxUpgrade abrowserUpgrade firefox-3.0 | Nov 8, 2024 | Nov 13, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub