CVE-2012-3959: Use-after-free vulnerability in the nsRangeUpdater::SelAdjDeleteNode function in Mozilla Firefox before 15....

Security readout for executives and security teams

This is an old memory-safety flaw in Mozilla browser and mail products. A malicious remote input could make an affected app corrupt heap memory, potentially crashing it or running attacker-chosen code. The listed fixed releases are from 2012, so exposure should mainly be legacy endpoints, old Linux packages, or vendor appliances still carrying those versions. Organizations are most likely exposed through unsupported legacy desktops, old mail clients, archived virtual machines, or third-party products bundling vulnerable Mozilla components. Modern fully patched Firefox, Thunderbird, and SeaMonkey deployments should not be affected based on the listed fixed versions. Prioritize this where legacy Mozilla software still exists, especially on systems that browse untrusted content or open external email. For current managed endpoints, this should be a verification and cleanup item, not an emergency unless unsupported versions are found. Mitigation focus: Upgrade Firefox to 15.0 or later, or ESR 10.0.7 or later.; Upgrade Thunderbird to 15.0 or later, or ESR 10.0.7 or later.; Upgrade SeaMonkey to 2.12 or later..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.