CVE-2008-5014: Canonical Ubuntu Linux

High severity, CVSS 10.0. EPSS: 5.9% chance of exploitation in the next 30 days.

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only; version 8.10 only
• Debian Debian Linux: version 4.0 only
• Mozilla Firefox: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18); from 3.0, before 3.0.2 (fixed in 3.0.2)
• Mozilla Seamonkey: from 1.0, before 1.1.13 (fixed in 1.1.13)
• Mozilla Thunderbird: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18)

Published 2008-11-13. Last modified 2026-06-16.