Description
The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | firefox +1 | 24.2.0-1.el6_5 | RHSA-2013:1823, RHSA-2013:1812 |
| RHEL 5 | firefox | 24.2.0-1.el5_10 | RHSA-2013:1812 |
| RHEL 5 | thunderbird | 24.2.0-2.el5_10 | RHSA-2013:1823 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 24.2.0-2.el5_10 | RHSA-2013:1823 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 5
- RHSA-2013:1823 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1812 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- openSUSE-SU-2013:1958 vendor-advisory
- SUSE-SU-2013:1919 vendor-advisory
- openSUSE-SU-2013:1957 vendor-advisory
- FEDORA-2013-23127 vendor-advisory
- FEDORA-2013-23519 vendor-advisory
- 1029470 vdb-entry
- openSUSE-SU-2013:1917 vendor-advisory
- openSUSE-SU-2013:1959 vendor-advisory
- GLSA-201504-01 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- openSUSE-SU-2013:1916 vendor-advisory
- openSUSE-SU-2014:0008 vendor-advisory
- 1029476 vdb-entry
- 64212 vdb-entry
- openSUSE-SU-2013:1918 vendor-advisory
- FEDORA-2013-23291 vendor-advisory
- USN-2052-1 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=930281
- http://www.mozilla.org/security/announce/2013/mfsa2013-111.html
- RHSA-2013:1812 vendor-advisory
- USN-2053-1 vendor-advisory
- FEDORA-2013-23295 vendor-advisory