Description
Multiple vulnerabilities in the Javascript engine in Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allow remote attackers to cause a denial of service (crash) via crafted HTML that triggers memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | iceape | 1.0.11~pre071022-0etch1+lenny1 | DTSA-80-1 |
| Debian 5.0 | icedove | 1.5.0.13+1.5.0.14b.dfsg1-0lenny1 | DTSA-71-1 |
| Debian 5.0 | xulrunner | 1.8.0.14~pre071019b-0lenny1 | DTSA-69-1 |
| Debian 4.0 | iceape | 1.0.11~pre071022-0etch1 | DSA-1401-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.14b.dfsg1-0etch1 | DSA-1391-1 |
| Debian 4.0 | iceweasel | 2.0.0.6+2.0.0.8-0etch1 | DSA-1396-1 |
| Debian 4.0 | xulrunner | 1.8.0.14~pre071019b-0etch1 | DSA-1392-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-6.el5 | RHSA-2007:0979 |
| RHEL 5 | thunderbird | 1.5.0.12-5.el5 | RHSA-2007:0981 |
| RHEL 4 | firefox | 1.5.0.12-0.7.el4 | RHSA-2007:0979 |
| RHEL 4 | seamonkey +5 | 1.0.9-6.el4 | RHSA-2007:0980 |
| RHEL 4 | thunderbird | 1.5.0.12-0.5.el4 | RHSA-2007:0981 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.5.el3 | RHSA-2007:0980 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.6.el2 | RHSA-2007:0980 |
Advisories 10
- RHSA-2007:0981 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0980 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0979 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-80-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-71-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-69-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1401-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1391-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1392-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1396-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2007-2601 vendor-advisory
- 20071026 rPSA-2007-0225-1 firefox mailing-list
- http://www.mozilla.org/security/announce/2007/mfsa2007-29.html
- 1018835 vdb-entry
- ADV-2007-3545 vdb-entry
- MDVSA-2008:047 vendor-advisory
- VU#755513 third-party-advisory
- ADV-2007-3587 vdb-entry
- 27414 third-party-advisory
- SUSE-SR:2008:002 vendor-advisory
- 20071029 FLEA-2007-0062-1 firefox mailing-list
- ADV-2008-0643 vdb-entry
- https://issues.rpath.com/browse/RPL-1858
- GLSA-200711-14 vendor-advisory
- HPSBUX02156 vendor-advisory
- 27360 third-party-advisory
- HPSBUX02153 vendor-advisory
- 27298 third-party-advisory
- 27315 third-party-advisory
- 27327 third-party-advisory
- ADV-2007-3544 vdb-entry
- 27276 third-party-advisory
- USN-535-1 vendor-advisory
- DSA-1391 vendor-advisory
- GLSA-200711-24 vendor-advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=372309%2C387955%2C390078%2C393537
- 28179 third-party-advisory
- 1018977 vendor-advisory
- 1018834 vdb-entry
- DSA-1401 vendor-advisory
- DSA-1392 vendor-advisory
- RHSA-2007:0980 vendor-advisory
- 27383 third-party-advisory
- SUSE-SA:2007:057 vendor-advisory
- MDVSA-2007:047 vendor-advisory
- mozilla-multiple-java-code-execution(37282) vdb-entry
- 27356 third-party-advisory
- oval:org.mitre.oval:def:9622 vdb-entry signature
- RHSA-2007:0981 vendor-advisory
- 27704 third-party-advisory
- ADV-2008-0083 vdb-entry
- 27387 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=196481
- FEDORA-2007-3431 vendor-advisory
- 27313 third-party-advisory
- 27403 third-party-advisory
- 27336 third-party-advisory
- ADV-2008-0082 vdb-entry
- 231441 vendor-advisory
- DSA-1396 vendor-advisory
- 27425 third-party-advisory
- 28398 third-party-advisory
- ADV-2007-4272 vdb-entry
- 27311 third-party-advisory
- 27325 third-party-advisory
- MDKSA-2007:202 vendor-advisory
- 27665 third-party-advisory
- RHSA-2007:0979 vendor-advisory
- 27335 third-party-advisory
- https://issues.rpath.com/browse/RPL-1884