| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | = 17.0= 17.0.1= 17.0.2= 17.0.3= 17.0.4= 17.0.5= 17.0.6= 17.0.7= 19.0= 19.0.1= 19.0.2= 20.0= 20.0.1= 21.0≤ 22.0 | |
| seamonkey | = 2.0= 2.0.1= 2.0.10= 2.0.11= 2.0.12= 2.0.13= 2.0.14= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.7= 2.0.8= 2.0.9= 2.1= 2.10= 2.10.1= 2.11= 2.12= 2.12.1= 2.13= 2.13.1= 2.13.2= 2.14= 2.15= 2.15.1= 2.15.2= 2.16= 2.16.1= 2.16.2= 2.17= 2.17.1= 2.18= 2.19= 2.2= 2.20= 2.3= 2.3.1= 2.3.2= 2.3.3= 2.4= 2.4.1= 2.5= 2.6= 2.6.1= 2.7= 2.7.1= 2.7.2= 2.8= 2.9= 2.9.1≤ 2.20 | |
| thunderbird | = 17.0= 17.0.1= 17.0.2= 17.0.3= 17.0.4= 17.0.5= 17.0.6≤ 17.0.7 | |
| thunderbird esr | = 17.0= 17.0.1= 17.0.2= 17.0.3= 17.0.4= 17.0.5= 17.0.6= 17.0.7 |
Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed pathname or other predictable pathname.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free