Description
Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to execute script outside of the sandbox and conduct cross-site scripting (XSS) attacks via multiple vectors including the XMLDocument.load function, aka "JavaScript privilege escalation bugs."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.12~pre080131b-0etch1 | DSA-1506-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1-0etch2 | DSA-1485-2 |
| Debian 4.0 | iceweasel | 2.0.0.12-0etch1 | DSA-1489-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080131b-0etch1 | DSA-1484-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-9.el5 | RHSA-2008:0103 |
| RHEL 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
| RHEL 4 | firefox | 1.5.0.12-0.10.el4 | RHSA-2008:0103 |
| RHEL 4 | seamonkey +5 | 1.0.9-9.el4 | RHSA-2008:0104 |
| RHEL 4 | thunderbird | 1.5.0.12-8.el4 | RHSA-2008:0105 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.9.el3 | RHSA-2008:0104 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.9.el2 | RHSA-2008:0104 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 9
- RHSA-2008:0104 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0105 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0103 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1489-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1506-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1484-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1485-2 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2008:0104 vendor-advisory
- USN-582-2 vendor-advisory
- USN-576-1 vendor-advisory
- http://browser.netscape.com/releasenotes/
- 28939 third-party-advisory
- DSA-1506 vendor-advisory
- SSA:2008-061-01 vendor-advisory
- https://issues.rpath.com/browse/RPL-1995
- FEDORA-2008-2118 vendor-advisory
- FEDORA-2008-2060 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
- 28766 third-party-advisory
- 28818 third-party-advisory
- 30620 third-party-advisory
- 28865 third-party-advisory
- 29049 third-party-advisory
- ADV-2008-0453 vdb-entry
- RHSA-2008:0103 vendor-advisory
- 28877 third-party-advisory
- 28879 third-party-advisory
- USN-582-1 vendor-advisory
- 29167 third-party-advisory
- 29567 third-party-advisory
- RHSA-2008:0105 vendor-advisory
- 28958 third-party-advisory
- http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html
- 30327 third-party-advisory
- 238492 vendor-advisory
- 20080229 rPSA-2008-0093-1 thunderbird mailing-list
- DSA-1489 vendor-advisory
- 20080212 FLEA-2008-0001-1 firefox mailing-list
- 20080209 rPSA-2008-0051-1 firefox mailing-list
- 29086 third-party-advisory
- 28815 third-party-advisory
- ADV-2008-0454 vdb-entry
- 239546 vendor-advisory
- 28864 third-party-advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=386695%2C393761%2C393762%2C399298%2C407289%2C372075%2C363597
- oval:org.mitre.oval:def:9897 vdb-entry signature
- DSA-1485 vendor-advisory
- 28924 third-party-advisory
- 27683 vdb-entry
- ADV-2008-1793 vdb-entry
- http://www.mozilla.org/security/announce/2008/mfsa2008-03.html
- 1019327 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2008-0093
- ADV-2008-2091 vdb-entry
- SUSE-SA:2008:008 vendor-advisory
- FEDORA-2008-1459 vendor-advisory
- 29164 third-party-advisory
- 29211 third-party-advisory
- FEDORA-2008-1535 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0051
- MDVSA-2008:062 vendor-advisory
- DSA-1484 vendor-advisory
- 28808 third-party-advisory
- ADV-2008-0627 vdb-entry
- GLSA-200805-18 vendor-advisory
- 28754 third-party-advisory
- 28758 third-party-advisory