Description
The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XML file with a crafted XSLT transform.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | xulrunner | 1.9.0.7-0lenny2 | DSA-1756-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xulrunner +2 | 1.9.0.7-3.el5 | RHSA-2009:0397 |
| RHEL 4 | firefox | 3.0.7-3.el4 | RHSA-2009:0397 |
| RHEL 4 | seamonkey +5 | 1.0.9-40.el4 | RHSA-2009:0398 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.36.el3 | RHSA-2009:0398 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.32.el2 | RHSA-2009:0398 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (1) EDB-8285 · dos · Mar 25, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2009:0397 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0398 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1756-1 xulrunner - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- SUSE-SA:2009:023 vendor-advisory
- mozilla-xslt-code-execution(49439) vdb-entry
- 34510 third-party-advisory
- 8285 exploit
- FEDORA-2009-3101 vendor-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-12.html
- 34511 third-party-advisory
- MDVSA-2009:084 vendor-advisory
- RHSA-2009:0397 vendor-advisory
- SUSE-SA:2009:022 vendor-advisory
- 1021939 vdb-entry
- 34505 third-party-advisory
- 34521 third-party-advisory
- RHSA-2009:0398 vendor-advisory
- 34486 third-party-advisory
- 34471 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=485286
- USN-745-1 vendor-advisory
- 34527 third-party-advisory
- 34235 vdb-entry
- DSA-1756 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=460090
- ADV-2009-0853 vdb-entry
- 34792 third-party-advisory
- http://blogs.zdnet.com/security/?p=3013
- https://bugzilla.mozilla.org/show_bug.cgi?id=485217
- FEDORA-2009-3100 vendor-advisory
- 34549 third-party-advisory
- 34550 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm
- oval:org.mitre.oval:def:11372 vdb-entry signature
- FEDORA-2009-3099 vendor-advisory