Description
EvalInSandbox in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to gain privileges via javascript that calls the valueOf method on objects that were created outside of the sandbox.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1.5.0.4-1 | — |
| Debian 13 | thunderbird | 1.5.0.4-1 | — |
| Debian 12 | thunderbird | 1.5.0.4-1 | — |
| Debian 3.1 | mozilla | 2:1.7.8-1sarge7.1 | DSA-1118 |
| Debian 3.1 | mozilla-firefox | 1.0.4-2sarge9 | DSA-1120 |
| Debian 3.1 | mozilla-thunderbird | 1.0.2-2.sarge1.0.8a | DSA-1134-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.10-0.2.el4 | RHSA-2006:0609 |
| RHEL 4 | firefox +1 | 1.5.0.5-0.el4.1 | RHSA-2006:0611, RHSA-2006:0610 |
| RHEL 4 | seamonkey +5 | 1.0.3-0.el4.1 | RHSA-2006:0609 |
| RHEL 3 | seamonkey +9 | 1.0.2-0.1.0.EL3 | RHSA-2006:0578 |
Advisories 7
- RHSA-2006:0611 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0609 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0610 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0578 Red Hat Security Advisory: seamonkey security update (was mozilla) Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1120 mozilla-firefox - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1118 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1134-1 mozilla-thunderbird - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20709 third-party-advisory
- 21176 third-party-advisory
- MDKSA-2006:145 vendor-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-31.html
- ADV-2006-3748 vdb-entry
- USN-297-3 vendor-advisory
- USN-296-1 vendor-advisory
- USN-323-1 vendor-advisory
- 20561 third-party-advisory
- 21210 third-party-advisory
- RHSA-2006:0594 vendor-advisory
- 21336 third-party-advisory
- 20382 third-party-advisory
- mozilla-valueof-sandbox-bypass(26842) vdb-entry
- 1016214 vdb-entry
- 20060602 rPSA-2006-0091-1 firefox thunderbird mailing-list
- ADV-2006-3749 vdb-entry
- RHSA-2006:0610 vendor-advisory
- 20376 third-party-advisory
- MDKSA-2006:146 vendor-advisory
- RHSA-2006:0609 vendor-advisory
- 21178 third-party-advisory
- 1016202 vdb-entry
- 21607 third-party-advisory
- 18228 vdb-entry
- 21532 third-party-advisory
- 21270 third-party-advisory
- ADV-2008-0083 vdb-entry
- 21188 third-party-advisory
- 21134 third-party-advisory
- 21631 third-party-advisory
- SSRT061181 vendor-advisory
- SSRT061236 vendor-advisory
- USN-296-2 vendor-advisory
- GLSA-200606-21 vendor-advisory
- DSA-1118 vendor-advisory
- DSA-1120 vendor-advisory
- RHSA-2006:0611 vendor-advisory
- DSA-1134 vendor-advisory
- GLSA-200606-12 vendor-advisory
- 21324 third-party-advisory
- 21183 third-party-advisory
- oval:org.mitre.oval:def:9491 vdb-entry signature
- 22066 third-party-advisory
- 21269 third-party-advisory
- SUSE-SA:2006:035 vendor-advisory
- USN-297-1 vendor-advisory
- RHSA-2006:0578 vendor-advisory
- ADV-2006-2106 vdb-entry
- MDKSA-2006:143 vendor-advisory
- 22065 third-party-advisory