The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade xulrunnerUpgrade xulrunner-devel | Dec 1, 2016 | Jun 25, 2013 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade seamonkey | Dec 10, 2025 | Jun 26, 2013 |
| Gentoo Linux | — | Upgrade www-client/seamonkey-bin.Upgrade mail-client/thunderbird.Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird-bin. | Oct 30, 2017 | Jun 25, 2013 |
| Mfsa2013 59 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 22.0Upgrade to Mozilla Firefox ESR version 17.0.7 | Jun 26, 2013 | Jun 25, 2013 |
| Mozilla Seamonkey | — | Upgrade to the latest version of Mozilla SeaMonkeyUpgrade to Mozilla SeaMonkey version 2.19 | Jul 16, 2013 | Jun 25, 2013 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 17.0.7Upgrade to Mozilla Thunderbird ESR version 17.0.7Upgrade to the latest version of Mozilla Thunderbird | Jun 26, 2013 | Jun 25, 2013 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade xulrunnerUpgrade xulrunner-devel | Oct 16, 2024 | Jun 26, 2013 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 25, 2013 |
| Suse | — | Upgrade xulrunner-32bitUpgrade sle-sdk-releaseUpgrade mozilla-js-32bitUpgrade MozillaThunderbird-translations-commonUpgrade seamonkey-venkmanUpgrade MozillaFirefox-branding-SLEDUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbird-develUpgrade MozillaThunderbirdUpgrade mozilla-jsUpgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-translations-otherUpgrade xulrunnerUpgrade MozillaFirefox-develUpgrade seamonkey-ircUpgrade seamonkey-translations-otherUpgrade MozillaThunderbird-buildsymbolsUpgrade MozillaFirefox-translationsUpgrade mozilla-nsprUpgrade mozilla-nspr-32bitUpgrade seamonkey-translations-commonUpgrade mozillafirefox-buildsymbolsUpgrade xulrunner-develUpgrade seamonkeyUpgrade seamonkey-dom-inspectorUpgrade mozillafirefox-branding-upstreamUpgrade MozillaFirefoxUpgrade mozilla-nspr-develUpgrade enigmailUpgrade xulrunner-buildsymbols | Feb 17, 2015 | Jun 25, 2013 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Nov 8, 2024 | Jun 26, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub