Description
The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1) a large switch statement, (2) certain uses of watch and eval, (3) certain uses of the mousedown event listener, and other vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.12~pre080131b-0etch1 | DSA-1506-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1-0etch2 | DSA-1485-2 |
| Debian 4.0 | iceweasel | 2.0.0.12-0etch1 | DSA-1489-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080131b-0etch1 | DSA-1484-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-9.el5 | RHSA-2008:0103 |
| RHEL 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
| RHEL 4 | firefox | 1.5.0.12-0.10.el4 | RHSA-2008:0103 |
| RHEL 4 | seamonkey +5 | 1.0.9-9.el4 | RHSA-2008:0104 |
| RHEL 4 | thunderbird | 1.5.0.12-8.el4 | RHSA-2008:0105 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.9.el3 | RHSA-2008:0104 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.9.el2 | RHSA-2008:0104 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
Advisories 7
- RHSA-2008:0104 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0105 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0103 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1489-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1506-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1484-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1485-2 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2008:0104 vendor-advisory
- USN-582-2 vendor-advisory
- USN-576-1 vendor-advisory
- http://browser.netscape.com/releasenotes/
- 28939 third-party-advisory
- DSA-1506 vendor-advisory
- SSA:2008-061-01 vendor-advisory
- https://issues.rpath.com/browse/RPL-1995
- FEDORA-2008-2118 vendor-advisory
- FEDORA-2008-2060 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
- 28766 third-party-advisory
- 28818 third-party-advisory
- 30620 third-party-advisory
- 28865 third-party-advisory
- 29049 third-party-advisory
- ADV-2008-0453 vdb-entry
- RHSA-2008:0103 vendor-advisory
- 28877 third-party-advisory
- 28879 third-party-advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=407720%2C390597%2C373344%2C398085%2C406572%2C391028%2C406036%2C402087
- USN-582-1 vendor-advisory
- 29167 third-party-advisory
- RHSA-2008:0105 vendor-advisory
- 28958 third-party-advisory
- 30327 third-party-advisory
- 238492 vendor-advisory
- 20080229 rPSA-2008-0093-1 thunderbird mailing-list
- DSA-1489 vendor-advisory
- 20080212 FLEA-2008-0001-1 firefox mailing-list
- 20080209 rPSA-2008-0051-1 firefox mailing-list
- 29086 third-party-advisory
- 28815 third-party-advisory
- ADV-2008-0454 vdb-entry
- 239546 vendor-advisory
- 28864 third-party-advisory
- DSA-1485 vendor-advisory
- 28924 third-party-advisory
- 27683 vdb-entry
- ADV-2008-1793 vdb-entry
- http://www.mozilla.org/security/announce/2008/mfsa2008-01.html
- http://wiki.rpath.com/Advisories:rPSA-2008-0093
- ADV-2008-2091 vdb-entry
- oval:org.mitre.oval:def:10385 vdb-entry signature
- SUSE-SA:2008:008 vendor-advisory
- FEDORA-2008-1459 vendor-advisory
- 29164 third-party-advisory
- 29211 third-party-advisory
- FEDORA-2008-1535 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0051
- MDVSA-2008:062 vendor-advisory
- DSA-1484 vendor-advisory
- 28808 third-party-advisory
- ADV-2008-0627 vdb-entry
- 1019321 vdb-entry
- GLSA-200805-18 vendor-advisory
- 28754 third-party-advisory
- 28758 third-party-advisory
- FEDORA-2008-1435 vendor-advisory
- MDVSA-2008:048 vendor-advisory