Description
Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080323b-0etch1 | DSA-1534-2, DSA-1534-1 |
| Debian 4.0 | iceweasel | 2.0.0.13-0etch1 | DSA-1535-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080323b-0etch1 | DSA-1532-1 |
Advisories 4
- DSA-1534-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1532-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1534-2 iceape - regression Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1535-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20080327 rPSA-2008-0128-1 firefox mailing-list
- 29541 third-party-advisory
- 29539 third-party-advisory
- 1019704 vdb-entry
- 30620 third-party-advisory
- 29560 third-party-advisory
- DSA-1532 vendor-advisory
- 30327 third-party-advisory
- 238492 vendor-advisory
- USN-592-1 vendor-advisory
- 29616 third-party-advisory
- 29645 third-party-advisory
- http://0x90.eu/ff_tls_poc.html
- ADV-2008-1793 vdb-entry
- 29558 third-party-advisory
- 29526 third-party-advisory
- SUSE-SA:2008:019 vendor-advisory
- TA08-087A third-party-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-17.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=395399
- 28448 vdb-entry
- DSA-1534 vendor-advisory
- 29547 third-party-advisory
- GLSA-200805-18 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
- ADV-2008-0998 vdb-entry
- DSA-1535 vendor-advisory
- MDVSA-2008:080 vendor-advisory