PT-2008-4244 · Mozilla+1 · Firefox+2

Claudio Santambrogio · Published 2008-07-02 · Updated 2018-10-11 · CVE-2008-2805

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 2.0.0.15 SeaMonkey versions prior to 1.1.10

Description The issue allows remote attackers to force the upload of arbitrary local files from a client computer. This is achieved through vectors involving originalTarget and DOM Range.

Recommendations For Mozilla Firefox versions prior to 2.0.0.15, update to version 2.0.0.15 or later. For SeaMonkey versions prior to 1.1.10, update to version 1.1.10 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2805

DSA-1607-1

DSA-1615-1

DSA-1697-1

RHSA-2008:0547

RHSA-2008:0549

RHSA-2008:0569

RHSA-2008:0616

RHSA-2008_0547

RHSA-2008_0549

RHSA-2008_0569

RHSA-2008_0616

Affected Products

Firefox

Red Hat

Seamonkey

References · 62

• http://redhat.com/support/errata/RHSA-2008-0569.html · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:136 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00288.html · Vendor Advisory
• http://ubuntu.com/usn/usn-619-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00295.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1697 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00207.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0549.html · Vendor Advisory
• http://secunia.com/advisories/30911 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-0616.html · Vendor Advisory
• http://debian.org/security/2008/dsa-1607 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0547.html · Vendor Advisory