PT-2008-2832 · Mozilla+1 · Firefox+2

Gregory Fleischer · Published 2008-03-28 · Updated 2018-10-11 · CVE-2008-1240

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9

Description The issue allows remote attackers to access arbitrary ports on the local machine due to improper parsing of the content origin for jar: URIs by LiveConnect before sending them to the Java plugin.

Recommendations For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

Fix

Related Identifiers

CVE-2008-1240

DSA-1532-1

DSA-1534-1

DSA-1534-2

DSA-1535-1

Affected Products

Java Plug-In

Firefox

Seamonkey

References · 27

• http://debian.org/security/2008/dsa-1535 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1240 · Security Note
• http://ubuntu.com/usn/usn-592-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1532 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:080 · Vendor Advisory
• http://debian.org/security/2008/dsa-1534 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200805-18.xml · Vendor Advisory
• http://securityfocus.com/bid/28448 · Note
• http://secunia.com/advisories/29616 · Note
• http://vupen.com/english/advisories/2008/0998/references · Note
• http://secunia.com/advisories/30620 · Note
• http://secunia.com/advisories/29560 · Note
• http://us-cert.gov/cas/techalerts/TA08-087A.html · Note