CVE-2008-1235
Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka "Privilege escalation via incorrect principals."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 6.05% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2008-0208.html
- http://secunia.com/advisories/29391Vendor Advisory
- http://secunia.com/advisories/29526Vendor Advisory
- http://secunia.com/advisories/29539Vendor Advisory
- http://secunia.com/advisories/29541Vendor Advisory
- http://secunia.com/advisories/29547Vendor Advisory
- http://secunia.com/advisories/29548Vendor Advisory
- http://secunia.com/advisories/29550Vendor Advisory
- http://secunia.com/advisories/29558Vendor Advisory
- http://secunia.com/advisories/29560Vendor Advisory
- http://secunia.com/advisories/29607Vendor Advisory
- http://secunia.com/advisories/29616Vendor Advisory
- http://secunia.com/advisories/29645Vendor Advisory
- http://secunia.com/advisories/30016Vendor Advisory
- http://secunia.com/advisories/30094Vendor Advisory
- http://secunia.com/advisories/30105Vendor Advisory
- http://secunia.com/advisories/30192Vendor Advisory
- http://secunia.com/advisories/30327Vendor Advisory
- http://secunia.com/advisories/30370Vendor Advisory
- http://secunia.com/advisories/30620Vendor Advisory
- http://secunia.com/advisories/31043Vendor Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
- http://www.debian.org/security/2008/dsa-1532
- http://www.debian.org/security/2008/dsa-1534
- http://www.debian.org/security/2008/dsa-1535
- http://www.debian.org/security/2008/dsa-1574
- http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.