Description
The IonMonkey JavaScript engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21, when Valgrind mode is used, does not properly initialize memory, which makes it easier for remote attackers to obtain sensitive information via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 3
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- oval:org.mitre.oval:def:18902 vdb-entry signature
- openSUSE-SU-2013:1491 vendor-advisory
- 62468 vdb-entry
- FEDORA-2013-16992 vendor-advisory
- FEDORA-2013-17074 vendor-advisory
- USN-1952-1 vendor-advisory
- USN-1951-1 vendor-advisory
- FEDORA-2013-17047 vendor-advisory
- openSUSE-SU-2013:1493 vendor-advisory
- openSUSE-SU-2013:1499 vendor-advisory
- http://www.mozilla.org/security/announce/2013/mfsa2013-85.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=883686
- openSUSE-SU-2013:1495 vendor-advisory