Description
The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | icedove | 2.0.0.22-0lenny1 | DSA-1830-1 |
| Debian 5.0 | xulrunner | 1.9.0.11-0lenny1 | DSA-1820-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.11-2.el5_3 | RHSA-2009:1095 |
| RHEL 5 | thunderbird | 2.0.0.22-2.el5_3 | RHSA-2009:1126 |
| RHEL 5 | xulrunner +2 | 1.9.0.11-3.el5_3 | RHSA-2009:1095 |
| RHEL 4 | firefox | 3.0.11-4.el4 | RHSA-2009:1095 |
| RHEL 4 | seamonkey +5 | 1.0.9-43.el4_8 | RHSA-2009:1096 |
| RHEL 4 | thunderbird | 1.5.0.12-23.el4 | RHSA-2009:1125 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.38.el3 | RHSA-2009:1096 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 2.0.0.22-2.el5_3 | RHSA-2009:1126 |
Advisories 6
- RHSA-2009:1095 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1125 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1096 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1820-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1830-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1126 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=489131
- ADV-2009-1572 vdb-entry
- RHSA-2009:1096 vendor-advisory
- oval:org.mitre.oval:def:11080 vdb-entry signature
- SSA:2009-178-01 vendor-advisory
- DSA-1830 vendor-advisory
- 35536 third-party-advisory
- 35602 third-party-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-29.html
- RHSA-2009:1125 vendor-advisory
- FEDORA-2009-7614 vendor-advisory
- 35326 vdb-entry
- 35440 third-party-advisory
- FEDORA-2009-6411 vendor-advisory
- USN-782-1 vendor-advisory
- 35428 third-party-advisory
- 35431 third-party-advisory
- FEDORA-2009-7567 vendor-advisory
- 35331 third-party-advisory
- 35468 third-party-advisory
- 35439 third-party-advisory
- 35882 third-party-advisory
- FEDORA-2009-6366 vendor-advisory
- MDVSA-2009:141 vendor-advisory
- 35415 third-party-advisory
- RHSA-2009:1095 vendor-advisory
- 35383 vdb-entry
- SSA:2009-167-01 vendor-advisory
- 55157 vdb-entry
- 35561 third-party-advisory
- SSA:2009-176-01 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=503580
- DSA-1820 vendor-advisory
- RHSA-2009:1126 vendor-advisory
- 264308 vendor-advisory
- 1022397 vdb-entry