Description
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | thunderbird | 1.5.0.7-1 | — |
| Debian 13 | thunderbird | 1.5.0.7-1 | — |
| Debian 12 | thunderbird | 1.5.0.7-1 | — |
| Debian 3.1 | mozilla | 2:1.7.8-1sarge7.3.1 | DSA-1192-1 |
| Debian 3.1 | mozilla-thunderbird | 1.0.2-2.sarge1.0.8c.1 | DSA-1191-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.10-0.4.el4 | RHSA-2006:0676 |
| RHEL 4 | seamonkey +5 | 1.0.5-0.1.el4 | RHSA-2006:0676 |
| RHEL 4 | thunderbird | 1.5.0.7-0.1.el4 | RHSA-2006:0677 |
| RHEL 3 | seamonkey +9 | 1.0.5-0.1.el3 | RHSA-2006:0676 |
Advisories 4
- RHSA-2006:0676 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0677 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1191-1 mozilla-thunderbird Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1192-1 mozilla Debian Security (DSA / DLA) · Mar 9, 2026
References
- 22391 third-party-advisory
- RHSA-2006:0676 vendor-advisory
- 22055 third-party-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-63.html
- USN-361-1 vendor-advisory
- USN-352-1 vendor-advisory
- 1016867 vdb-entry
- 22056 third-party-advisory
- 22247 third-party-advisory
- DSA-1191 vendor-advisory
- GLSA-200610-04 vendor-advisory
- 1016866 vdb-entry
- 21939 third-party-advisory
- 21915 third-party-advisory
- oval:org.mitre.oval:def:10892 vdb-entry signature
- RHSA-2006:0677 vendor-advisory
- DSA-1192 vendor-advisory
- 22274 third-party-advisory
- 21940 third-party-advisory
- 20042 vdb-entry
- thunderbird-seamonkey-xbl-code-execution(28962) vdb-entry
- USN-350-1 vendor-advisory
- 22342 third-party-advisory
- GLSA-200610-01 vendor-advisory
- 22074 third-party-advisory
- 22088 third-party-advisory
- SUSE-SA:2006:054 vendor-advisory
- 22036 third-party-advisory
- 22299 third-party-advisory
- MDKSA-2006:169 vendor-advisory
- 21916 third-party-advisory