The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade linux-thunderbirdUpgrade firefox-esrUpgrade thunderbirdUpgrade seamonkeyUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade firefox | Dec 10, 2025 | Apr 29, 2014 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade dev-libs/nspr.Upgrade www-client/firefox.Upgrade www-client/seamonkey.Upgrade www-client/seamonkey-bin.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird. | Oct 30, 2017 | Apr 30, 2014 |
| Mfsa2014 47 | — | Upgrade to Mozilla Firefox version 29.0Upgrade to the latest version of Mozilla Firefox | Apr 30, 2014 | Apr 29, 2014 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.26.0 | Dec 8, 2014 | Apr 30, 2014 |
| Oracle Solaris | — | Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Apr 30, 2014 |
| Suse | — | Upgrade MozillaFirefox-develUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translations-common | Dec 18, 2015 | Apr 30, 2014 |
| Ubuntu | — | Upgrade firefox | Nov 8, 2024 | Apr 30, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub