Description
The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 3
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- openSUSE-SU-2013:1958 vendor-advisory
- SUSE-SU-2013:1919 vendor-advisory
- openSUSE-SU-2013:1957 vendor-advisory
- FEDORA-2013-23127 vendor-advisory
- FEDORA-2013-23519 vendor-advisory
- 1029470 vdb-entry
- openSUSE-SU-2013:1917 vendor-advisory
- openSUSE-SU-2013:1959 vendor-advisory
- http://www.mozilla.org/security/announce/2013/mfsa2013-115.html
- GLSA-201504-01 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- openSUSE-SU-2013:1916 vendor-advisory
- openSUSE-SU-2014:0008 vendor-advisory
- 1029476 vdb-entry
- openSUSE-SU-2013:1918 vendor-advisory
- FEDORA-2013-23291 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=929261
- USN-2052-1 vendor-advisory
- USN-2053-1 vendor-advisory
- FEDORA-2013-23295 vendor-advisory