Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent JavaScript workers from reading the browser-profile directory name, which has unspecified impact and remote attack vectors.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade firefoxUpgrade linux-thunderbirdUpgrade libxulUpgrade thunderbirdUpgrade linux-firefoxUpgrade seamonkeyUpgrade linux-seamonkey | Dec 10, 2025 | Feb 19, 2013 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey-bin.Upgrade mail-client/thunderbird.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey. | Oct 30, 2017 | Feb 19, 2013 |
| Mfsa2013 25 | — | Upgrade to Mozilla Firefox version 19.0Upgrade to Mozilla Firefox ESR version 17.0.3 | Feb 21, 2013 | Feb 19, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.16.0 | Feb 21, 2013 | Feb 19, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 17.0.3Upgrade to Mozilla Thunderbird ESR version 17.0.3 | Feb 21, 2013 | Feb 19, 2013 |
| Suse | — | Upgrade mozilla-nss-x86Upgrade MozillaThunderbird-buildsymbolsUpgrade sle-sdk-releaseUpgrade xulrunner-32bitUpgrade firefox3-python-baseUpgrade seamonkeyUpgrade xulrunner-develUpgrade beagle-firefoxUpgrade seamonkey-translations-commonUpgrade beagle-langUpgrade xulrunner-debuginfo-32bitUpgrade seamonkey-translations-otherUpgrade mozilla-js-debuginfo-32bitUpgrade beagle-evolutionUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-develUpgrade mozilla-nspr-32bitUpgrade chmsee-debuginfoUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-otherUpgrade libfreebl3-32bitUpgrade xulrunner-debuginfoUpgrade beagle-guiUpgrade mozilla-nss-32bitUpgrade MozillaThunderbird-debugsourceUpgrade beagle-develUpgrade beagleUpgrade mozilla-nss-toolsUpgrade seamonkey-ircUpgrade mozilla-js-32bitUpgrade mozilla-js-debuginfoUpgrade enigmailUpgrade mozilla-nss-64bitUpgrade MozillaThunderbird-devel-debuginfoUpgrade MozillaThunderbirdUpgrade seamonkey-dom-inspectorUpgrade seamonkey-debuginfoUpgrade mozilla-jsUpgrade libfreebl3Upgrade mozilla-nspr-64bitUpgrade enigmail-debuginfoUpgrade mozilla-nssUpgrade xulrunner-x86Upgrade MozillaFirefox-translationsUpgrade seamonkey-debugsourceUpgrade xulrunner-buildsymbolsUpgrade xulrunner-debuginfo-x86Upgrade mozilla-nsprUpgrade seamonkey-venkmanUpgrade MozillaFirefox-translations-commonUpgrade xulrunner-devel-debuginfoUpgrade chmseeUpgrade MozillaThunderbird-debuginfoUpgrade mozilla-js-x86Upgrade xulrunnerUpgrade MozillaFirefox-develUpgrade MozillaFirefox-debugsourceUpgrade MozillaFirefox-debuginfoUpgrade mozillafirefox-buildsymbolsUpgrade MozillaThunderbird-translations-commonUpgrade xulrunner-debugsourceUpgrade MozillaThunderbird-develUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nspr-develUpgrade libfreebl3-x86Upgrade mozilla-nspr-x86Upgrade mhtml-firefoxUpgrade mozillafirefox-branding-upstreamUpgrade chmsee-debugsourceUpgrade mozilla-js-debuginfo-x86 | Feb 17, 2015 | Feb 19, 2013 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 8, 2024 | Feb 19, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub