Description
The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins that reduce the precision.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 45.0esr-1 | — |
| Debian 13 | firefox-esr | 45.0esr-1 | — |
| Debian 12 | firefox-esr | 45.0esr-1 | — |
| Debian 3.1 | mozilla | 2:1.7.8-1sarge10 | DSA-1265-1 |
| Debian 3.1 | mozilla-firefox | 1.0.4-2sarge15 | DSA-1253-1 |
| Debian 3.1 | mozilla-thunderbird | 1.0.2-2.sarge1.0.8e.2 | DSA-1258-1 |
Advisories 3
- DSA-1258-1 mozilla-thunderbird Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1265-1 mozilla Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1253-1 mozilla-firefox Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21668 vdb-entry
- 23672 third-party-advisory
- ADV-2006-5068 vdb-entry
- 1017398 vdb-entry
- DSA-1265 vendor-advisory
- 24078 third-party-advisory
- 23692 third-party-advisory
- USN-398-2 vendor-advisory
- GLSA-200701-04 vendor-advisory
- 23282 third-party-advisory
- 24390 third-party-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-68.html
- 23422 third-party-advisory
- HPSBUX02153 vendor-advisory
- 23591 third-party-advisory
- ADV-2007-1124 vdb-entry
- 1017405 vdb-entry
- 23614 third-party-advisory
- 1017406 vdb-entry
- USN-398-1 vendor-advisory
- ADV-2008-0083 vdb-entry
- 23420 third-party-advisory
- SUSE-SA:2006:080 vendor-advisory
- VU#427972 third-party-advisory
- 23545 third-party-advisory
- 102846 vendor-advisory
- TA06-354A third-party-advisory
- 23589 third-party-advisory
- DSA-1253 vendor-advisory
- DSA-1258 vendor-advisory
- SUSE-SA:2007:006 vendor-advisory
- 23988 third-party-advisory
- GLSA-200701-02 vendor-advisory
- USN-400-1 vendor-advisory