Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 do not properly implement access to a content object through a SafeJSObjectWrapper (aka SJOW) wrapper, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging "access to an object from the chrome scope."
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade xulrunnerUpgrade xulrunner-devel | Dec 1, 2016 | Jul 30, 2010 |
| Freebsd | — | Upgrade linux-firefoxUpgrade seamonkeyUpgrade firefoxUpgrade thunderbirdUpgrade linux-firefox-devel | Dec 10, 2025 | Jul 21, 2010 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade www-client/mozilla-firefox.Upgrade www-client/icecat.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade net-libs/xulrunner.Upgrade dev-libs/nss.Upgrade www-client/mozilla-firefox-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey.Upgrade mail-client/mozilla-thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade net-libs/xulrunner-bin. | Oct 30, 2017 | Jul 30, 2010 |
| Mfsa2010 38 | — | Upgrade to Mozilla Firefox version 3.6.7 | Jun 14, 2012 | Jul 30, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.1 | Feb 22, 2012 | Jul 30, 2010 |
| Oracle_linux | — | Upgrade firefoxUpgrade xulrunnerUpgrade xulrunner-devel | Oct 16, 2024 | Jul 30, 2010 |
| Suse | — | Upgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner192-translationsUpgrade MozillaFirefoxUpgrade mozilla-xulrunner192-develUpgrade mozilla-xulrunner192-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner192Upgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner192-gnome-32bitUpgrade MozillaFirefox-develUpgrade mozilla-xulrunner192-x86Upgrade mozilla-xulrunner192-translations-32bitUpgrade MozillaFirefox-translations-other | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade firefox-3.0Upgrade xulrunner-1.9.2Upgrade abrowserUpgrade firefox-3.5 | Nov 8, 2024 | Jul 30, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub