The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging access to an unprivileged object.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade linux-seamonkeyUpgrade thunderbirdUpgrade firefoxUpgrade linux-thunderbirdUpgrade seamonkeyUpgrade linux-firefox | Dec 10, 2025 | Aug 8, 2013 |
| Gentoo Linux | — | Upgrade www-client/firefox-bin.Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird.Upgrade mail-client/thunderbird-bin.Upgrade www-client/seamonkey-bin. | Oct 30, 2017 | Aug 6, 2013 |
| Mfsa2013 70 | — | Upgrade to Mozilla Firefox version 23.0Upgrade to the latest version of Mozilla Firefox | Aug 7, 2013 | Aug 6, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.20.0 | Dec 8, 2014 | Aug 6, 2013 |
| Suse | — | Upgrade xulrunner-buildsymbolsUpgrade mozillafirefox-branding-upstreamUpgrade mozilla-nssUpgrade MozillaThunderbirdUpgrade xulrunnerUpgrade mozilla-nsprUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-develUpgrade libfreebl3Upgrade mozilla-nspr-develUpgrade mozilla-jsUpgrade MozillaThunderbird-develUpgrade libsoftokn3-32bitUpgrade mozillafirefox-buildsymbolsUpgrade seamonkey-venkmanUpgrade mozilla-nss-sysinitUpgrade seamonkey-dom-inspectorUpgrade mozilla-nss-32bitUpgrade mozilla-nspr-32bitUpgrade mozilla-js-32bitUpgrade seamonkeyUpgrade mozilla-nss-develUpgrade seamonkey-translations-otherUpgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-certsUpgrade enigmailUpgrade MozillaFirefoxUpgrade libsoftokn3Upgrade MozillaThunderbird-buildsymbolsUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-toolsUpgrade seamonkey-ircUpgrade seamonkey-translations-commonUpgrade xulrunner-32bitUpgrade mozilla-nss-sysinit-32bitUpgrade libfreebl3-32bitUpgrade xulrunner-devel | Feb 17, 2015 | Aug 6, 2013 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Aug 7, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub