The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade seamonkey-nsprUpgrade seamonkey-js-debuggerUpgrade seamonkey-develUpgrade seamonkey-nss-develUpgrade seamonkey-nssUpgrade seamonkey-mailUpgrade seamonkey-dom-inspectorUpgrade seamonkeyUpgrade seamonkey-nspr-develUpgrade seamonkey-chatUpgrade thunderbird | Dec 1, 2016 | Dec 17, 2008 |
| Freebsd | — | Upgrade seamonkeyUpgrade linux-firefoxUpgrade firefoxUpgrade linux-thunderbirdUpgrade thunderbirdUpgrade linux-seamonkey | Dec 10, 2025 | Dec 19, 2008 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade dev-libs/nss.Upgrade www-client/seamonkey.Upgrade www-client/seamonkey-bin.Upgrade www-client/icecat.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox.Upgrade mail-client/thunderbird-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/thunderbird.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Dec 17, 2008 |
| Mfsa2008 61 | — | Upgrade to Mozilla Firefox version 2.0.0.19 | Jun 14, 2012 | Dec 17, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.14 | Feb 3, 2012 | Dec 17, 2008 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 2.0.0.19 | Feb 22, 2012 | Dec 17, 2008 |
| Suse | — | Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner190Upgrade MozillaThunderbird-develUpgrade mozilla-venkmanUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade seamonkey-venkmanUpgrade MozillaThunderbird-translationsUpgrade seamonkey-dom-inspectorUpgrade mozilla-xulrunner190-64bitUpgrade mozilla-xulrunner181-64bitUpgrade mozillaUpgrade mozilla-calendarUpgrade mozilla-huUpgrade MozillaFirefoxUpgrade gecko-sdkUpgrade MozillaFirefox-translationsUpgrade mozilla-dom-inspectorUpgrade mozilla-xulrunner190-translations-32bitUpgrade epiphanyUpgrade seamonkey-spellcheckerUpgrade seamonkeyUpgrade mozilla-deatUpgrade python-xpcom190Upgrade mozilla-xulrunner181-32bitUpgrade mozilla-xulrunner181-develUpgrade seamonkey-mailUpgrade mozilla-xulrunner190-translationsUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner181-l10n-32bitUpgrade mozilla-ircUpgrade mozilla-develUpgrade mozilla-mailUpgrade mozilla-csUpgrade mozilla-xulrunner190-develUpgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade mozilla-xulrunner181Upgrade mozilla-xulrunner181-l10nUpgrade mozilla-xulrunner190-translations-64bitUpgrade seamonkey-ircUpgrade mozilla-xulrunner190-32bit | Feb 17, 2015 | Dec 17, 2008 |
| Ubuntu | — | Upgrade thunderbirdUpgrade mozilla-thunderbirdUpgrade firefox | Nov 8, 2024 | Dec 17, 2008 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub