Description
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors involving "double frame construction."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | icedove | 2.0.0.22-0lenny1 | DSA-1830-1 |
| Debian 5.0 | xulrunner | 1.9.0.11-0lenny1 | DSA-1820-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.11-2.el5_3 | RHSA-2009:1095 |
| RHEL 5 | xulrunner +2 | 1.9.0.11-3.el5_3 | RHSA-2009:1095 |
| RHEL 4 | firefox | 3.0.11-4.el4 | RHSA-2009:1095 |
Advisories 3
- RHSA-2009:1095 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1820-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1830-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=484031
- 265068 vendor-advisory
- ADV-2009-1572 vdb-entry
- 1020800 vendor-advisory
- SSA:2009-178-01 vendor-advisory
- DSA-1830 vendor-advisory
- oval:org.mitre.oval:def:10237 vdb-entry signature
- 35602 third-party-advisory
- FEDORA-2009-7614 vendor-advisory
- 35326 vdb-entry
- 35440 third-party-advisory
- FEDORA-2009-6411 vendor-advisory
- 35431 third-party-advisory
- 55148 vdb-entry
- FEDORA-2009-7567 vendor-advisory
- 35331 third-party-advisory
- 35468 third-party-advisory
- ADV-2009-2152 vdb-entry
- 35439 third-party-advisory
- 35882 third-party-advisory
- FEDORA-2009-6366 vendor-advisory
- MDVSA-2009:141 vendor-advisory
- 35415 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=503569
- RHSA-2009:1095 vendor-advisory
- 1022376 vdb-entry
- SSA:2009-167-01 vendor-advisory
- 35561 third-party-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-24.html
- SSA:2009-176-01 vendor-advisory
- DSA-1820 vendor-advisory
- 1022397 vdb-entry
- 35371 vdb-entry