Description
Multiple vulnerabilities in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption or assert errors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.11~pre071022-0etch1+lenny1 | DTSA-80-1 |
| Debian 5.0 | icedove | 1.5.0.13+1.5.0.14b.dfsg1-0lenny1 | DTSA-71-1 |
| Debian 5.0 | xulrunner | 1.8.0.14~pre071019b-0lenny1 | DTSA-69-1 |
| Debian 4.0 | iceape | 1.0.11~pre071022-0etch1 | DSA-1401-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.14b.dfsg1-0etch1 | DSA-1391-1 |
| Debian 4.0 | iceweasel | 2.0.0.6+2.0.0.8-0etch1 | DSA-1396-1 |
| Debian 4.0 | xulrunner | 1.8.0.14~pre071019b-0etch1 | DSA-1392-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-6.el5 | RHSA-2007:0979 |
| RHEL 5 | thunderbird | 1.5.0.12-5.el5 | RHSA-2007:0981 |
| RHEL 4 | firefox | 1.5.0.12-0.7.el4 | RHSA-2007:0979 |
| RHEL 4 | seamonkey +5 | 1.0.9-6.el4 | RHSA-2007:0980 |
| RHEL 4 | thunderbird | 1.5.0.12-0.5.el4 | RHSA-2007:0981 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.5.el3 | RHSA-2007:0980 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.6.el2 | RHSA-2007:0980 |
Advisories 10
- RHSA-2007:0981 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0980 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0979 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-80-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-71-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-69-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1401-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1391-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1392-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1396-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2007-2601 vendor-advisory
- 20071026 rPSA-2007-0225-1 firefox mailing-list
- http://www.mozilla.org/security/announce/2007/mfsa2007-29.html
- 1018835 vdb-entry
- ADV-2007-3545 vdb-entry
- MDVSA-2008:047 vendor-advisory
- ADV-2007-3587 vdb-entry
- 27414 third-party-advisory
- SUSE-SR:2008:002 vendor-advisory
- 20071029 FLEA-2007-0062-1 firefox mailing-list
- ADV-2008-0643 vdb-entry
- https://issues.rpath.com/browse/RPL-1858
- GLSA-200711-14 vendor-advisory
- oval:org.mitre.oval:def:10459 vdb-entry signature
- HPSBUX02156 vendor-advisory
- 27360 third-party-advisory
- HPSBUX02153 vendor-advisory
- 27298 third-party-advisory
- 27315 third-party-advisory
- 27327 third-party-advisory
- ADV-2007-3544 vdb-entry
- 27276 third-party-advisory
- USN-535-1 vendor-advisory
- DSA-1391 vendor-advisory
- GLSA-200711-24 vendor-advisory
- 28179 third-party-advisory
- 1018977 vendor-advisory
- VU#559977 third-party-advisory
- 1018834 vdb-entry
- DSA-1401 vendor-advisory
- DSA-1392 vendor-advisory
- SSA:2007-324-01 vendor-advisory
- RHSA-2007:0980 vendor-advisory
- 27383 third-party-advisory
- SUSE-SA:2007:057 vendor-advisory
- MDVSA-2007:047 vendor-advisory
- 27356 third-party-advisory
- RHSA-2007:0981 vendor-advisory
- 27704 third-party-advisory
- ADV-2008-0083 vdb-entry
- 27387 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=196481
- FEDORA-2007-3431 vendor-advisory
- 27313 third-party-advisory
- 27403 third-party-advisory
- mozilla-multiple-browser-code-execution(37281) vdb-entry
- 27744 third-party-advisory
- 27336 third-party-advisory
- ADV-2008-0082 vdb-entry
- 231441 vendor-advisory
- DSA-1396 vendor-advisory
- 27425 third-party-advisory
- 28398 third-party-advisory
- ADV-2007-4272 vdb-entry
- 27311 third-party-advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=309322%2C330563%2C341858%2C344064%2C348126%2C354645%2C361745%2C362901%2C378670%2C378682%2C379799%2C382376%2C384105%2C386382%2C386914%2C387033%2C387460%2C387844%2C391974%2C392285%2C393770%2C394014%2C394418
- 27325 third-party-advisory
- MDKSA-2007:202 vendor-advisory
- 27665 third-party-advisory
- RHSA-2007:0979 vendor-advisory