PT-2008-6570 · Mozilla+2 · Thunderbird+4

Boris Zbarsky + 1 · Publicado 2008-12-17 · Atualizado 2024-06-15 · CVE-2008-5503

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 2.0.0 through 2.0.18 Thunderbird versions 2.0.0 through 2.0.18 SeaMonkey versions 1.0 through 1.1.13

Description The issue is related to the loadBindingDocument function, which does not enforce the same-domain policy, allowing remote attackers to access data from other domains using crafted XBL bindings.

Recommendations For Mozilla Firefox versions 2.0.0 through 2.0.18, update to version 2.0.0.19 or later. For Thunderbird versions 2.0.0 through 2.0.18, update to version 2.0.0.19 or later. For SeaMonkey versions 1.0 through 1.1.13, update to version 1.1.14 or later.

Exploit

Correção

Identificadores relacionados

CVE-2008-5503

DSA-1696-1

DSA-1697-1

DSA-1704-1

DSA-1707-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10601-1

RHSA-2008:1037

RHSA-2008_1037

RHSA-2009:0002

RHSA-2009_0002

Produtos afetados

Firefox

Red Hat

Seamonkey

Suse

Thunderbird

Referências · 1438

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://suse.com/security/cve/CVE-2018-12374 · Nota