PT-2008-4371 · Red Hat+1 · Devhelp+7

Billy Rios + 1 · Publicado 2008-07-16 · Atualizado 2018-10-11 · CVE-2008-2933

Mitre

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-2933

DSA-1614-1

DSA-1615-1

DSA-1697-1

RHSA-2008:0597

RHSA-2008:0598

RHSA-2008_0597

RHSA-2008_0598

Produtos afetados

Devhelp

Devhelp-Devel

Firefox

Nspluginwrapper

Xulrunner

Xulrunner-Devel

Xulrunner-Devel-Unstable

Yelp

Referências · 44

• https://access.redhat.com/security/cve/CVE-2008-2933 · Nota
• http://secunia.com/advisories/31145 · Nota
• https://access.redhat.com/security/cve/CVE-2008-2785 · Nota
• http://vupen.com/english/advisories/2009/0977 · Nota
• http://secunia.com/advisories/34501 · Nota
• http://mozilla.org/security/announce/2008/mfsa2008-35.html · Nota
• http://secunia.com/advisories/31270 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43832 · Nota
• http://kb.cert.org/vuls/id/130923 · Nota
• http://debian.org/security/2008/dsa-1615 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200808-03.xml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2933 · Nota de Segurança
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1 · Aviso do Fabricante
• http://secunia.com/advisories/31121 · Nota
• http://secunia.com/advisories/31377 · Nota