The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nss-pkcs11-develUpgrade yelpUpgrade thunderbirdUpgrade seamonkey-nssUpgrade xulrunnerUpgrade devhelp-develUpgrade nss-toolsUpgrade seamonkey-nspr-develUpgrade seamonkey-chatUpgrade firefoxUpgrade seamonkey-mailUpgrade seamonkeyUpgrade seamonkey-js-debuggerUpgrade nss-develUpgrade seamonkey-nsprUpgrade nssUpgrade xulrunner-devel-unstableUpgrade seamonkey-develUpgrade seamonkey-dom-inspectorUpgrade xulrunner-develUpgrade seamonkey-nss-develUpgrade devhelp | Dec 1, 2016 | Nov 13, 2008 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade firefoxUpgrade thunderbirdUpgrade linux-seamonkeyUpgrade linux-firefoxUpgrade seamonkey | Dec 10, 2025 | Nov 13, 2008 |
| Gentoo Linux | — | Upgrade www-client/icecat.Upgrade www-client/firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade net-libs/xulrunner.Upgrade net-libs/xulrunner-bin.Upgrade dev-libs/nss.Upgrade mail-client/thunderbird-bin.Upgrade www-client/mozilla-firefox.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey. | Oct 30, 2017 | Nov 13, 2008 |
| Mfsa2008 56 | — | Upgrade to Mozilla Firefox version 2.0.0.18Upgrade to Mozilla Firefox version 3.0.4 | Jun 14, 2012 | Nov 13, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.13 | Feb 3, 2012 | Nov 13, 2008 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 2.0.0.18 | Feb 22, 2012 | Nov 13, 2008 |
| Oracle_linux | — | Upgrade xulrunner-develUpgrade nss-develUpgrade devhelp-develUpgrade firefoxUpgrade yelpUpgrade nss-pkcs11-develUpgrade devhelpUpgrade nssUpgrade xulrunner-devel-unstableUpgrade nss-toolsUpgrade xulrunner | Oct 16, 2024 | Nov 13, 2008 |
| Suse | — | Upgrade mozilla-xulrunner190-translations-32bitUpgrade mozilla-dom-inspectorUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade mozilla-csUpgrade mozilla-xulrunner190-64bitUpgrade mozilla-xulrunner190-translationsUpgrade mozilla-calendarUpgrade mozilla-xulrunner181-64bitUpgrade mozilla-xulrunner190-translations-64bitUpgrade mozilla-xulrunner181-develUpgrade gecko-sdkUpgrade seamonkey-venkmanUpgrade mozilla-xulrunner190-develUpgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner181Upgrade mozilla-xulrunner181-32bitUpgrade mozillaUpgrade seamonkey-mailUpgrade seamonkeyUpgrade epiphany-develUpgrade MozillaThunderbird-develUpgrade epiphany-extensionsUpgrade mozilla-ircUpgrade epiphanyUpgrade mozilla-mailUpgrade mozilla-xulrunner190Upgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade MozillaFirefox-translationsUpgrade epiphany-docUpgrade mozilla-develUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner181-l10nUpgrade suse-releaseUpgrade mozilla-venkmanUpgrade MozillaFirefoxUpgrade mozilla-huUpgrade seamonkey-spellcheckerUpgrade seamonkey-ircUpgrade mozilla-deatUpgrade seamonkey-dom-inspectorUpgrade MozillaThunderbird-translationsUpgrade mozilla-xulrunner190-32bit | Feb 17, 2015 | Nov 13, 2008 |
| Ubuntu | — | Upgrade mozilla-thunderbirdUpgrade abrowserUpgrade firefoxUpgrade xulrunner-1.9Upgrade thunderbirdUpgrade firefox-3.0 | Nov 8, 2024 | Nov 13, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub