The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corruption, related to the GetXMLEntity and FastAppendChar functions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | 2.0 (including) | 2.0.0.19 (excluding) |
| Firefox | Mozilla | 3.0 (including) | 3.0.5 (excluding) |
| Seamonkey | Mozilla | 1.0 (including) | 1.1.14 (excluding) |