Description
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080614i-0etch1 | DSA-1697-1 |
| Debian 4.0 | iceweasel | 2.0.0.18-0etch1 | DSA-1671-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080614h-0etch1 | DSA-1669-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | seamonkey +5 | 1.0.9-28.el4 | RHSA-2008:0977 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.25.el3 | RHSA-2008:0977 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.21.el2 | RHSA-2008:0977 |
Advisories 4
- RHSA-2008:0977 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1697-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1669-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1671-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2008-3146 vdb-entry
- DSA-1697 vendor-advisory
- DSA-1671 vendor-advisory
- 32281 vdb-entry
- FEDORA-2008-9667 vendor-advisory
- RHSA-2008:0977 vendor-advisory
- ADV-2009-0977 vdb-entry
- DSA-1669 vendor-advisory
- 32778 third-party-advisory
- 33433 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=433610
- 256408 vendor-advisory
- SUSE-SA:2008:055 vendor-advisory
- 32694 third-party-advisory
- TA08-319A third-party-advisory
- 32853 third-party-advisory
- oval:org.mitre.oval:def:9660 vdb-entry signature
- 32693 third-party-advisory
- 1021181 vdb-entry
- http://www.mozilla.org/security/announce/2008/mfsa2008-49.html
- MDVSA-2008:228 vendor-advisory
- 32845 third-party-advisory
- 32684 third-party-advisory
- USN-667-1 vendor-advisory
- 32714 third-party-advisory
- 34501 third-party-advisory