PT-2008-4371 · Red Hat+1 · Devhelp+7

Billy Rios + 1 · Published 2008-07-16 · Updated 2018-10-11 · CVE-2008-2933

Mitre

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2933

DSA-1614-1

DSA-1615-1

DSA-1697-1

RHSA-2008:0597

RHSA-2008:0598

RHSA-2008_0597

RHSA-2008_0598

Affected Products

Devhelp

Devhelp-Devel

Firefox

Nspluginwrapper

Xulrunner

Xulrunner-Devel

Xulrunner-Devel-Unstable

Yelp

References · 44

• http://debian.org/security/2008/dsa-1615 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200808-03.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2933 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0597.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:148 · Vendor Advisory
• http://ubuntu.com/usn/usn-626-1 · Vendor Advisory
• http://ubuntu.com/usn/usn-626-2 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0598.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1697 · Vendor Advisory
• http://ubuntu.com/usn/usn-623-1 · Vendor Advisory
• http://debian.org/security/2008/dsa-1614 · Vendor Advisory
• http://slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.380974 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2008-2933 · Note
• http://secunia.com/advisories/31145 · Note