The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade ca_root_nssUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade libxulUpgrade seamonkeyUpgrade firefoxUpgrade linux-thunderbirdUpgrade thunderbird | Dec 10, 2025 | Jan 9, 2013 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade www-client/seamonkey.Upgrade www-client/firefox.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird. | Oct 30, 2017 | Jan 13, 2013 |
| Mfsa2013 14 | — | Upgrade to Mozilla Firefox version 18.0Upgrade to Mozilla Firefox ESR version 17.0.2 | Nov 21, 2013 | Jan 13, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.15.0 | Nov 21, 2013 | Jan 13, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 17.0.2Upgrade to Mozilla Thunderbird ESR version 17.0.2 | Nov 21, 2013 | Jan 13, 2013 |
| Suse | — | Upgrade libfreebl3-x86Upgrade MozillaFirefox-debugsourceUpgrade xulrunner-debuginfoUpgrade seamonkey-venkmanUpgrade mozilla-nss-sysinit-x86Upgrade seamonkeyUpgrade enigmail-debuginfoUpgrade mozilla-nss-certs-debuginfo-32bitUpgrade mozilla-nsprUpgrade xulrunnerUpgrade mozillafirefox-branding-upstreamUpgrade libsoftokn3-debuginfoUpgrade mozilla-nss-sysinit-debuginfo-32bitUpgrade mozilla-js-x86Upgrade mozillafirefox-translations-commonUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-sysinitUpgrade libfreebl3-debuginfo-32bitUpgrade xulrunner-x86Upgrade mozilla-nspr-debugsourceUpgrade MozillaThunderbird-debuginfoUpgrade mozilla-nspr-debuginfoUpgrade libfreebl3Upgrade mozillafirefox-branding-sledUpgrade libsoftokn3-debuginfo-32bitUpgrade xulrunner-buildsymbolsUpgrade mozilla-nss-debuginfo-32bitUpgrade firefox3-pangoUpgrade MozillaThunderbird-buildsymbolsUpgrade mozilla-jsUpgrade mozilla-nss-debugsourceUpgrade mozilla-nspr-develUpgrade xulrunner-devel-debuginfoUpgrade xulrunner-debugsourceUpgrade MozillaThunderbird-develUpgrade mozilla-nssUpgrade xulrunner-32bitUpgrade mozilla-nspr-64bitUpgrade firefox3-cairo-32bitUpgrade mozillafirefox-buildsymbolsUpgrade mozilla-nss-certsUpgrade mozilla-nss-tools-debuginfoUpgrade mozilla-nss-64bitUpgrade MozillaThunderbird-devel-debuginfoUpgrade seamonkey-debugsourceUpgrade sle-sdk-releaseUpgrade libsoftokn3-x86Upgrade mozilla-js-debuginfo-32bitUpgrade libsoftokn3-32bitUpgrade mozillathunderbirdUpgrade libfreebl3-32bitUpgrade mozilla-nss-certs-debuginfo-x86Upgrade mozillathunderbird-translations-commonUpgrade mozilla-js-debuginfo-x86Upgrade firefox3-pango-32bitUpgrade mozilla-nss-certs-debuginfoUpgrade mozillafirefox-develUpgrade mozilla-nss-debuginfoUpgrade MozillaFirefox-translationsUpgrade firefox3-gtk2Upgrade xulrunner-develUpgrade mozillafirefox-translations-otherUpgrade mozilla-nss-sysinit-debuginfo-x86Upgrade mozilla-nss-32bitUpgrade MozillaThunderbird-debugsourceUpgrade mozilla-nss-sysinit-debuginfoUpgrade mozillathunderbird-translations-otherUpgrade libfreebl3-debuginfo-x86Upgrade mozilla-nspr-debuginfo-x86Upgrade libsoftokn3Upgrade MozillaFirefox-debuginfoUpgrade seamonkey-debuginfoUpgrade seamonkey-dom-inspectorUpgrade mozilla-nss-certs-x86Upgrade firefox3-gtk2-32bitUpgrade mozilla-nss-develUpgrade mozilla-nss-debuginfo-x86Upgrade mozilla-js-debuginfoUpgrade xulrunner-debuginfo-32bitUpgrade mozilla-nspr-x86Upgrade mozilla-nss-toolsUpgrade mozilla-nss-x86Upgrade mozilla-js-32bitUpgrade libfreebl3-debuginfoUpgrade mozilla-nss-sysinit-32bitUpgrade mozillafirefoxUpgrade mozilla-nss-certs-32bitUpgrade firefox3-cairoUpgrade seamonkey-translations-commonUpgrade seamonkey-ircUpgrade seamonkey-translations-otherUpgrade mozilla-nspr-debuginfo-32bitUpgrade libsoftokn3-debuginfo-x86Upgrade enigmailUpgrade xulrunner-debuginfo-x86 | Feb 17, 2015 | Jan 13, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 8, 2024 | Jan 13, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub