The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper (aka SJOW) implementation in Mozilla Firefox 3.6.x before 3.6.9 and Thunderbird 3.1.x before 3.1.3 does not properly restrict objects at the end of scope chains, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via vectors related to a chrome privileged object and a chain ending in an outer object.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nspr-develUpgrade nsprUpgrade xulrunnerUpgrade nss-develUpgrade nss-pkcs11-develUpgrade nssUpgrade nss-toolsUpgrade xulrunner-develUpgrade firefox | Dec 1, 2016 | Sep 9, 2010 |
| Freebsd | — | Upgrade linux-firefoxUpgrade thunderbirdUpgrade libxulUpgrade seamonkeyUpgrade firefoxUpgrade linux-firefox-devel | Dec 10, 2025 | Sep 8, 2010 |
| Gentoo Linux | — | Upgrade www-client/seamonkey-bin.Upgrade dev-libs/nss.Upgrade www-client/mozilla-firefox.Upgrade www-client/icecat.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner.Upgrade www-client/firefox-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/thunderbird.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade mail-client/thunderbird-bin.Upgrade net-libs/xulrunner-bin. | Oct 30, 2017 | Sep 9, 2010 |
| Mfsa2010 59 | — | Upgrade to Mozilla Firefox version 3.6.9 | Jun 14, 2012 | Sep 9, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.1.3 | Feb 22, 2012 | Sep 9, 2010 |
| Oracle_linux | — | Upgrade nss-develUpgrade firefoxUpgrade nss-toolsUpgrade nsprUpgrade xulrunnerUpgrade nspr-develUpgrade nssUpgrade nss-pkcs11-develUpgrade xulrunner-devel | Oct 16, 2024 | Sep 9, 2010 |
| Suse | — | Upgrade mozilla-xulrunner191-x86Upgrade MozillaThunderbird-develUpgrade MozillaThunderbird-translations-commonUpgrade libidl-32bitUpgrade orbit2-x86Upgrade mozilla-xulrunner192-translations-32bitUpgrade libidl-x86Upgrade libfreebl3Upgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner190-32bitUpgrade orbit2Upgrade MozillaFirefox-branding-SLEDUpgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner192-x86Upgrade gconf2-32bitUpgrade libfreebl3-x86Upgrade mozilla-xulrunner192-develUpgrade mozilla-nsprUpgrade MozillaFirefox-develUpgrade mozilla-nssUpgrade mozilla-xulrunner192Upgrade mozilla-xulrunner192-gnomeUpgrade libidlUpgrade mozilla-xulrunner192-gnome-32bitUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-32bitUpgrade mozilla-nspr-x86Upgrade MozillaFirefoxUpgrade mozilla-xulrunner190-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-nss-x86Upgrade mozilla-nss-toolsUpgrade mozilla-nspr-32bitUpgrade libfreebl3-32bitUpgrade gconf2-x86Upgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner190Upgrade orbit2-32bitUpgrade mozilla-xulrunner191Upgrade gconf2Upgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner192-32bit | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade firefox-3.5Upgrade xulrunner-1.9.2Upgrade abrowserUpgrade firefox-3.0Upgrade xulrunner-1.9.1 | Nov 8, 2024 | Sep 9, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub