Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict read access to the statusText property of XMLHttpRequest objects, which allows remote attackers to discover the existence of intranet web servers via cross-origin requests.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nssUpgrade nss-develUpgrade xulrunnerUpgrade nss-toolsUpgrade nspr-develUpgrade nss-pkcs11-develUpgrade xulrunner-develUpgrade firefoxUpgrade nspr | Dec 1, 2016 | Sep 9, 2010 |
| Freebsd | — | Upgrade linux-firefoxUpgrade firefoxUpgrade thunderbirdUpgrade seamonkeyUpgrade linux-firefox-develUpgrade libxul | Dec 10, 2025 | Sep 8, 2010 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird.Upgrade net-libs/xulrunner.Upgrade www-client/icecat.Upgrade www-client/seamonkey-bin.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird-bin.Upgrade www-client/mozilla-firefox.Upgrade www-client/firefox.Upgrade net-libs/xulrunner-bin.Upgrade mail-client/mozilla-thunderbird.Upgrade dev-libs/nss.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Sep 9, 2010 |
| Mfsa2010 63 | — | Upgrade to Mozilla Firefox version 3.6.9Upgrade to Mozilla Firefox version 3.5.12 | Jun 14, 2012 | Sep 9, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.7 | Feb 3, 2012 | Sep 9, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.0.7Upgrade to Mozilla Thunderbird version 3.1.3 | Feb 22, 2012 | Sep 9, 2010 |
| Oracle_linux | — | Upgrade nspr-develUpgrade nsprUpgrade nss-develUpgrade nssUpgrade xulrunnerUpgrade firefoxUpgrade nss-toolsUpgrade nss-pkcs11-develUpgrade xulrunner-devel | Oct 16, 2024 | Sep 9, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 7, 2010 |
| Suse | — | Upgrade MozillaFirefox-translations-commonUpgrade mozilla-xulrunner191Upgrade libfreebl3-32bitUpgrade mozilla-nss-x86Upgrade libidlUpgrade mozilla-xulrunner192-gnome-32bitUpgrade mozilla-nspr-x86Upgrade mozilla-xulrunner192-32bitUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translationsUpgrade mozilla-nss-toolsUpgrade gconf2Upgrade mozilla-nss-32bitUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner190-translationsUpgrade MozillaFirefoxUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner191-gnomevfsUpgrade gconf2-x86Upgrade mozilla-xulrunner190Upgrade MozillaThunderbird-translations-commonUpgrade mozilla-nsprUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-xulrunner192-develUpgrade orbit2Upgrade mozilla-nssUpgrade libfreebl3-x86Upgrade MozillaThunderbird-translations-otherUpgrade mozilla-xulrunner191-translationsUpgrade libidl-x86Upgrade gconf2-32bitUpgrade libidl-32bitUpgrade MozillaThunderbirdUpgrade mozilla-xulrunner192-gnomeUpgrade orbit2-32bitUpgrade mozilla-xulrunner191-x86Upgrade mozilla-nspr-32bitUpgrade orbit2-x86Upgrade mozilla-xulrunner190-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-xulrunner192-translations-32bitUpgrade MozillaThunderbird-develUpgrade mozilla-xulrunner192Upgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner192-x86Upgrade libfreebl3Upgrade MozillaFirefox-devel | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade abrowserUpgrade firefox-3.0Upgrade xulrunner-1.9.1Upgrade thunderbirdUpgrade xulrunner-1.9.2Upgrade firefoxUpgrade firefox-3.5 | Nov 8, 2024 | Sep 9, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub