Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | 3.0.7 (including) | 3.0.7 (including) |
| Red Hat Enterprise Linux 2.1 | RedHat | seamonkey-0:1.0.9-0.32.el2 | * |
| Red Hat Enterprise Linux 3 | RedHat | seamonkey-0:1.0.9-0.36.el3 | * |
| Red Hat Enterprise Linux 4 | RedHat | firefox-0:3.0.7-3.el4 | * |
| Red Hat Enterprise Linux 4 | RedHat | seamonkey-0:1.0.9-40.el4 | * |
| Red Hat Enterprise Linux 5 | RedHat | xulrunner-0:1.9.0.7-3.el5 | * |
| Firefox | Ubuntu | dapper | * |
| Firefox | Ubuntu | gutsy | * |
| Firefox | Ubuntu | hardy | * |
| Xulrunner | Ubuntu | gutsy | * |
| Xulrunner | Ubuntu | hardy | * |
| Xulrunner | Ubuntu | intrepid | * |
| Xulrunner | Ubuntu | jaunty | * |
| Xulrunner | Ubuntu | karmic | * |
| Xulrunner-1.9 | Ubuntu | gutsy | * |
| Xulrunner-1.9 | Ubuntu | hardy | * |
| Xulrunner-1.9 | Ubuntu | intrepid | * |
| Xulrunner-1.9 | Ubuntu | jaunty | * |
| Xulrunner-1.9.1 | Ubuntu | jaunty | * |
| Xulrunner-1.9.1 | Ubuntu | karmic | * |