Description
Multiple vulnerabilities in the JavaScript engine for Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.10~pre070720-0etch1+lenny1 | DTSA-47-1 |
| Debian 5.0 | icedove | 1.5.0.12.dfsg1-0etch1+lenny1 | DTSA-46-1 |
| Debian 5.0 | iceweasel | 2.0.0.5-0etch1+lenny1 | DTSA-45-1 |
| Debian 5.0 | xulrunner | 1.8.0.13~pre070720-0etch3+lenny1 | DTSA-51-1 |
| Debian 4.0 | iceape | 1.0.9-0etch1 | DSA-1300-1 |
| Debian 4.0 | icedove | 1.5.0.12.dfsg1-0etch1 | DSA-1305-1 |
| Debian 4.0 | iceweasel | 2.0.0.4-0etch1 | DSA-1308-1 |
| Debian 4.0 | xulrunner | 1.8.0.12-0etch1 | DSA-1306-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-11.el5 | RHSA-2007:0400 |
| RHEL 5 | firefox +1 | 1.5.0.12-1.el5 | RHSA-2007:0401, RHSA-2007:0400 |
| RHEL 5 | yelp | 2.16.0-15.el5 | RHSA-2007:0400 |
| RHEL 4 | devhelp +1 | 0.10-0.8.el4 | RHSA-2007:0402 |
| RHEL 4 | firefox +1 | 1.5.0.12-0.1.el4 | RHSA-2007:0401, RHSA-2007:0400 |
| RHEL 4 | seamonkey +5 | 1.0.9-2.el4 | RHSA-2007:0402 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.1.el3 | RHSA-2007:0402 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.1.el2 | RHSA-2007:0402 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-1.el5 | RHSA-2007:0401 |
Advisories 11
- RHSA-2007:0400 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0402 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0401 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-51-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1300-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1306-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-47-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1308-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-45-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1305-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-46-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 25496 third-party-advisory
- 1018153 vdb-entry
- FEDORA-2007-308 vendor-advisory
- DSA-1308 vendor-advisory
- 27427 third-party-advisory
- 1018151 vdb-entry
- 201505 vendor-advisory
- oval:org.mitre.oval:def:10711 vdb-entry signature
- http://www.mozilla.org/security/announce/2007/mfsa2007-12.html
- HPSBUX02156 vendor-advisory
- MDKSA-2007:120 vendor-advisory
- 20070531 FLEA-2007-0023-1: firefox mailing-list
- 24406 third-party-advisory
- 25647 third-party-advisory
- 25469 third-party-advisory
- HPSBUX02153 vendor-advisory
- 103125 vendor-advisory
- SUSE-SA:2007:036 vendor-advisory
- 25491 third-party-advisory
- GLSA-200706-06 vendor-advisory
- 25635 third-party-advisory
- 25534 third-party-advisory
- ADV-2007-1994 vdb-entry
- RHSA-2007:0400 vendor-advisory
- FEDORA-2007-309 vendor-advisory
- SSA:2007-152-02 vendor-advisory
- USN-469-1 vendor-advisory
- MDKSA-2007:131 vendor-advisory
- DSA-1305 vendor-advisory
- 25533 third-party-advisory
- DSA-1306 vendor-advisory
- 1018152 vdb-entry
- https://issues.rpath.com/browse/RPL-1424
- 25664 third-party-advisory
- MDKSA-2007:119 vendor-advisory
- SSA:2007-066-04 vendor-advisory
- 24456 third-party-advisory
- 25644 third-party-advisory
- 25858 third-party-advisory
- USN-468-1 vendor-advisory
- VU#609956 third-party-advisory
- ADV-2008-0082 vdb-entry
- RHSA-2007:0401 vendor-advisory
- 25476 third-party-advisory
- ADV-2007-3632 vdb-entry
- mozilla-javascripteng-code-execution(34605) vdb-entry
- 35138 vdb-entry
- 24242 vdb-entry
- 25750 third-party-advisory
- 25489 third-party-advisory
- DSA-1300 vendor-advisory
- 25559 third-party-advisory
- 28363 third-party-advisory
- 25490 third-party-advisory
- 25488 third-party-advisory
- 25492 third-party-advisory
- RHSA-2007:0402 vendor-advisory
- TA07-151A third-party-advisory
- 25685 third-party-advisory
- 20070620 FLEA-2007-0027-1: thunderbird mailing-list