PT-2008-1160 · Mozilla · Firefox

Published 2008-05-21 · Updated 2017-08-08 · CVE-2008-2419

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 2.0.0.14

Description The issue is related to errors in resource management and can be triggered by loading an empty Java applet defined by a 'src="javascript:"' sequence in certain Iframe operations. This can cause a denial of service, resulting in heap corruption and application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited by running specific JavaScript code in empty applet objects within iframes.

Recommendations For Mozilla Firefox version 2.0.0.14, consider avoiding the use of iframes with empty Java applets defined by a 'src="javascript:"' sequence until a fix is available. As a temporary workaround, restrict the execution of JavaScript code within iframes to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2020-04517

CVE-2008-2419

Affected Products

Firefox

References · 8

• 🔥 http://0x000000.com/?i=576 · Exploit
• 🔥 http://securityfocus.com/bid/29318 · Exploit
• 🔥 https://exploit-db.com/exploits/31817 · Exploit
• https://bdu.fstec.ru/vul/2020-04517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-2419 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2008-2419 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42589 · Note
• https://cve.omprussia.ru/bb1321 · Note