The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade seamonkey-nss-develUpgrade seamonkey-nssUpgrade seamonkey-develUpgrade seamonkey-mailUpgrade seamonkey-js-debuggerUpgrade seamonkey-nsprUpgrade thunderbirdUpgrade seamonkey-chatUpgrade seamonkey-nspr-develUpgrade seamonkeyUpgrade seamonkey-dom-inspector | Dec 1, 2016 | Dec 17, 2008 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade firefoxUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade seamonkeyUpgrade linux-firefox | Dec 10, 2025 | Dec 19, 2008 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade net-libs/xulrunner-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade dev-libs/nss.Upgrade www-client/seamonkey-bin.Upgrade www-client/icecat.Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox. | Oct 30, 2017 | Dec 17, 2008 |
| Mfsa2008 61 | — | Upgrade to Mozilla Firefox version 2.0.0.19 | Jun 14, 2012 | Dec 17, 2008 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.14 | Feb 3, 2012 | Dec 17, 2008 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 2.0.0.19 | Feb 22, 2012 | Dec 17, 2008 |
| Suse | — | Upgrade mozilla-csUpgrade mozilla-xulrunner181Upgrade seamonkey-mailUpgrade MozillaThunderbirdUpgrade mozilla-deatUpgrade mozilla-xulrunner190-translations-64bitUpgrade mozilla-xulrunner181-32bitUpgrade mozilla-ircUpgrade mozilla-xulrunner181-l10nUpgrade mozilla-xulrunner190-gnomevfs-64bitUpgrade mozilla-xulrunner190-develUpgrade python-xpcom190Upgrade mozilla-xulrunner181-develUpgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner181-l10n-32bitUpgrade epiphanyUpgrade mozilla-mailUpgrade mozilla-develUpgrade seamonkey-spellcheckerUpgrade seamonkeyUpgrade seamonkey-ircUpgrade mozilla-xulrunner190-translations-32bitUpgrade mozilla-dom-inspectorUpgrade MozillaThunderbird-translationsUpgrade mozilla-xulrunner181-64bitUpgrade mozilla-calendarUpgrade mozilla-huUpgrade mozilla-xulrunner190Upgrade seamonkey-dom-inspectorUpgrade seamonkey-venkmanUpgrade mozillaUpgrade mozilla-xulrunner190-gnomevfsUpgrade MozillaFirefoxUpgrade mozilla-xulrunner190-64bitUpgrade MozillaFirefox-translationsUpgrade gecko-sdkUpgrade mozilla-venkmanUpgrade mozilla-xulrunner190-gnomevfs-32bitUpgrade MozillaThunderbird-devel | Feb 17, 2015 | Dec 17, 2008 |
| Ubuntu | — | Upgrade firefoxUpgrade mozilla-thunderbirdUpgrade thunderbird | Nov 8, 2024 | Dec 17, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub