|Description||Mozilla Firefox before 184.108.40.206, Thunderbird before 220.127.116.11, and SeaMonkey before 1.0.3 allows scripts with the UniversalBrowserRead privilege to gain UniversalXPConnect privileges and possibly execute code or obtain sensitive data by reading into a privileged context.|
|Source||CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)|
|References||DSA-1159, DSA-1160, DSA-1161|
|NVD severity||high (attack range: remote)|
|Debian/oldoldstable||not known to be vulnerable.|
|Debian/stable||not known to be vulnerable.|
|Debian/testing||not known to be vulnerable.|
|Debian/unstable||not known to be vulnerable.|
Vulnerable and fixed packages
The table below lists information on source packages.
|xulrunner (PTS)||wheezy, wheezy (security)||24.8.1esr-2~deb7u1||fixed|
The information below is based on the following data on fixed versions.