Description
Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code by leveraging incorrect garbage collection in situations involving default compartments and frame-chain restoration.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 3
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- openSUSE-SU-2013:1491 vendor-advisory
- FEDORA-2013-16992 vendor-advisory
- oval:org.mitre.oval:def:18766 vdb-entry signature
- FEDORA-2013-17074 vendor-advisory
- USN-1952-1 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=887334
- USN-1951-1 vendor-advisory
- FEDORA-2013-17047 vendor-advisory
- openSUSE-SU-2013:1493 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=882897
- openSUSE-SU-2013:1499 vendor-advisory
- 62466 vdb-entry
- http://www.mozilla.org/security/announce/2013/mfsa2013-92.html
- openSUSE-SU-2013:1495 vendor-advisory