Description
Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nspr | 4.8.2-1 | — |
| Debian 13 | nspr | 4.8.2-1 | — |
| Debian 12 | nspr | 4.8.2-1 | — |
| Debian 5.0 | icedove | 2.0.0.24-0lenny1 | DSA-2025-1 |
| Debian 5.0 | nspr | 4.7.1-5 | DSA-1931-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.12-1.el5_3 | RHSA-2009:1162 |
| RHEL 5 | thunderbird | 2.0.0.24-2.el5_4 | RHSA-2010:0153 |
| RHEL 5 | xulrunner +2 | 1.9.0.12-1.el5_3 | RHSA-2009:1162 |
| RHEL 4 | firefox | 3.0.12-1.el4 | RHSA-2009:1162 |
| RHEL 4 | seamonkey +5 | 1.0.9-45.el4_8 | RHSA-2009:1163 |
| RHEL 4 | thunderbird | 1.5.0.12-25.el4 | RHSA-2010:0154 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.40.el3 | RHSA-2009:1163 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 2.0.0.24-2.el5_4 | RHSA-2010:0153 |
Advisories 6
- RHSA-2009:1162 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0154 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1163 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2025-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1931-1 nspr - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2010:0153 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 265068 vendor-advisory
- 1020800 vendor-advisory
- RHSA-2010:0153 vendor-advisory
- 39001 third-party-advisory
- oval:org.mitre.oval:def:10369 vdb-entry signature
- https://bugzilla.mozilla.org/show_bug.cgi?id=492779
- FEDORA-2009-7961 vendor-advisory
- 36145 third-party-advisory
- 35944 third-party-advisory
- ADV-2010-0648 vdb-entry
- ADV-2010-0650 vdb-entry
- 35943 third-party-advisory
- SUSE-SR:2010:013 vendor-advisory
- 38977 third-party-advisory
- SUSE-SA:2009:039 vendor-advisory
- RHSA-2009:1162 vendor-advisory
- http://www.mozilla.org/security/announce/2009/mfsa2009-34.html
- RHSA-2010:0154 vendor-advisory
- 35758 vdb-entry
- ADV-2009-2152 vdb-entry
- 36005 third-party-advisory
- RHSA-2009:1163 vendor-advisory
- 35947 third-party-advisory
- SUSE-SA:2009:042 vendor-advisory
- USN-915-1 vendor-advisory
- 35914 third-party-advisory
- ADV-2009-1972 vdb-entry
- http://www.mozilla.org/security/announce/2010/mfsa2010-07.html