Description
Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the (1) pkcs11.addmodule and (2) pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | xulrunner | 1.9.0.14-0lenny1 | DSA-1885-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.14-1.el5_4 | RHSA-2009:1430 |
| RHEL 5 | nspr +1 | 4.7.5-1.el5_4 | RHSA-2009:1430 |
| RHEL 5 | thunderbird | 2.0.0.24-2.el5_4 | RHSA-2010:0153 |
| RHEL 5 | xulrunner +2 | 1.9.0.14-1.el5_4 | RHSA-2009:1430 |
| RHEL 4 | firefox | 3.0.14-1.el4 | RHSA-2009:1430 |
| RHEL 4 | nspr +1 | 4.7.5-1.el4_8 | RHSA-2009:1430 |
| RHEL 4 | seamonkey +5 | 1.0.9-48.el4_8 | RHSA-2009:1431 |
| RHEL 4 | thunderbird | 1.5.0.12-25.el4 | RHSA-2010:0154 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.45.el3 | RHSA-2009:1432 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 2.0.0.24-2.el5_4 | RHSA-2010:0153 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Mozilla Firefox < 3.0.14 - Multiplatform Remote Code Execution via pkcs11.addmodule EDB-9651 · remote · Sep 11, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2009:1432 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1430 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0154 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1431 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1885-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2010:0153 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 1022877 vdb-entry
- oval:org.mitre.oval:def:9306 vdb-entry signature
- DSA-1885 vendor-advisory
- RHSA-2010:0153 vendor-advisory
- 36343 vdb-entry
- SUSE-SA:2009:048 vendor-advisory
- RHSA-2009:1430 vendor-advisory
- oval:org.mitre.oval:def:6140 vdb-entry signature
- ADV-2010-0650 vdb-entry
- http://www.mozilla.org/security/announce/2009/mfsa2009-48.html
- 36692 third-party-advisory
- 36670 third-party-advisory
- 36671 third-party-advisory
- 36669 third-party-advisory
- RHSA-2010:0154 vendor-advisory
- RHSA-2009:1432 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=326628
- https://bugzilla.mozilla.org/show_bug.cgi?id=509413
- 37098 third-party-advisory
- RHSA-2009:1431 vendor-advisory