Description
Mozilla Firefox 2.0 before 2.0.0.8 allows remote attackers to obtain sensitive system information by using the addMicrosummaryGenerator sidebar method to access file: URIs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceweasel | 2.0.0.6+2.0.0.8-0etch1 | DSA-1396-1 |
Advisories 1
- DSA-1396-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200711-14 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=390983
- USN-535-1 vendor-advisory
- 27387 third-party-advisory
- firefox-addmicrosummary-info-disclosure(37428) vdb-entry
- 27665 third-party-advisory
- 27335 third-party-advisory
- FEDORA-2007-2664 vendor-advisory
- 42470 vdb-entry