Description
Multiple vulnerabilities in the layout engine for Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2 allow remote attackers to cause a denial of service (crash) via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 |
| Debian 5.0 | icedove | 1.5.0.12.dfsg1-0etch1+lenny1 | DTSA-46-1 |
| Debian 5.0 | iceweasel | 2.0.0.5-0etch1+lenny1 | DTSA-45-1 |
| Debian 5.0 | xulrunner | 1.8.0.13~pre070720-0etch3+lenny1 | DTSA-51-1 |
| Debian 4.0 | iceape | 1.0.9-0etch1 | DSA-1300-1 |
| Debian 4.0 | icedove | 1.5.0.12.dfsg1-0etch1 | DSA-1305-1 |
| Debian 4.0 | iceweasel | 2.0.0.4-0etch1 | DSA-1308-1 |
| Debian 4.0 | xulrunner | 1.8.0.12-0etch1 | DSA-1306-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-11.el5 | RHSA-2007:0400 |
| RHEL 5 | firefox +1 | 1.5.0.12-1.el5 | RHSA-2007:0401, RHSA-2007:0400 |
| RHEL 5 | yelp | 2.16.0-15.el5 | RHSA-2007:0400 |
| RHEL 4 | devhelp +1 | 0.10-0.8.el4 | RHSA-2007:0402 |
| RHEL 4 | firefox +1 | 1.5.0.12-0.1.el4 | RHSA-2007:0401, RHSA-2007:0400 |
| RHEL 4 | seamonkey +5 | 1.0.9-2.el4 | RHSA-2007:0402 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.1.el3 | RHSA-2007:0402 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.1.el2 | RHSA-2007:0402 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-1.el5 | RHSA-2007:0401 |
Advisories 11
- RHSA-2007:0400 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0402 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0401 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-51-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1300-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1306-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-47-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1308-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-45-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1305-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-46-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 25496 third-party-advisory
- 1018153 vdb-entry
- FEDORA-2007-308 vendor-advisory
- DSA-1308 vendor-advisory
- mozilla-layoutengine-dos(34604) vdb-entry
- 1018151 vdb-entry
- http://www.mozilla.org/security/announce/2007/mfsa2007-12.html
- HPSBUX02156 vendor-advisory
- MDKSA-2007:120 vendor-advisory
- 27423 third-party-advisory
- 20070531 FLEA-2007-0023-1: firefox mailing-list
- 24406 third-party-advisory
- 25647 third-party-advisory
- 25469 third-party-advisory
- HPSBUX02153 vendor-advisory
- 35134 vdb-entry
- SUSE-SA:2007:036 vendor-advisory
- 25491 third-party-advisory
- GLSA-200706-06 vendor-advisory
- 25635 third-party-advisory
- 25534 third-party-advisory
- ADV-2007-1994 vdb-entry
- RHSA-2007:0400 vendor-advisory
- FEDORA-2007-309 vendor-advisory
- SSA:2007-152-02 vendor-advisory
- USN-469-1 vendor-advisory
- MDKSA-2007:131 vendor-advisory
- DSA-1305 vendor-advisory
- 25533 third-party-advisory
- oval:org.mitre.oval:def:10066 vdb-entry signature
- DSA-1306 vendor-advisory
- https://issues.rpath.com/browse/RPL-1424
- VU#751636 third-party-advisory
- 25664 third-party-advisory
- MDKSA-2007:119 vendor-advisory
- SSA:2007-066-04 vendor-advisory
- 103136 vendor-advisory
- 24456 third-party-advisory
- 25644 third-party-advisory
- 25858 third-party-advisory
- USN-468-1 vendor-advisory
- ADV-2008-0082 vdb-entry
- RHSA-2007:0401 vendor-advisory
- 25476 third-party-advisory
- MDKSA-2007:126 vendor-advisory
- 201532 vendor-advisory
- 24242 vdb-entry
- 25750 third-party-advisory
- ADV-2007-3664 vdb-entry
- 25489 third-party-advisory
- DSA-1300 vendor-advisory
- 25559 third-party-advisory
- 28363 third-party-advisory
- 25490 third-party-advisory
- 25488 third-party-advisory
- 25492 third-party-advisory
- RHSA-2007:0402 vendor-advisory
- TA07-151A third-party-advisory
- 25685 third-party-advisory
- 20070620 FLEA-2007-0027-1: thunderbird mailing-list