PT-2008-1160 · Mozilla · Firefox

Publicado 2008-05-21 · Atualizado 2017-08-08 · CVE-2008-2419

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 2.0.0.14

Description The issue is related to errors in resource management and can be triggered by loading an empty Java applet defined by a 'src="javascript:"' sequence in certain Iframe operations. This can cause a denial of service, resulting in heap corruption and application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited by running specific JavaScript code in empty applet objects within iframes.

Recommendations For Mozilla Firefox version 2.0.0.14, consider avoiding the use of iframes with empty Java applets defined by a 'src="javascript:"' sequence until a fix is available. As a temporary workaround, restrict the execution of JavaScript code within iframes to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2020-04517

CVE-2008-2419

Produtos afetados

Firefox

Referências · 8

• 🔥 http://0x000000.com/?i=576 · Exploit
• 🔥 http://securityfocus.com/bid/29318 · Exploit
• 🔥 https://exploit-db.com/exploits/31817 · Exploit
• https://bdu.fstec.ru/vul/2020-04517 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2008-2419 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-2419 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42589 · Nota
• https://cve.omprussia.ru/bb1321 · Nota