VulnerabilityModified
CVE-2008-4067
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a ..
MEDIUM 4.3EPSS 4.44%
Does this matter?
Lower severity and a low EPSS score (4.44%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 4.44% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · debian/debian linux · canonical/ubuntu linux
- Source
- secalert@redhat.com
References
- http://download.novell.com/Download?buildid=WZXONb-tqBw~Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.htmlThird Party Advisory
- http://secunia.com/advisories/31984Third Party Advisory
- http://secunia.com/advisories/31985Third Party Advisory
- http://secunia.com/advisories/31987Third Party Advisory
- http://secunia.com/advisories/32007Third Party Advisory
- http://secunia.com/advisories/32010Third Party Advisory
- http://secunia.com/advisories/32011Third Party Advisory
- http://secunia.com/advisories/32012Third Party Advisory
- http://secunia.com/advisories/32025Third Party Advisory
- http://secunia.com/advisories/32042Third Party Advisory
- http://secunia.com/advisories/32044Third Party Advisory
- http://secunia.com/advisories/32082Third Party Advisory
- http://secunia.com/advisories/32089Third Party Advisory
- http://secunia.com/advisories/32092Third Party Advisory
- http://secunia.com/advisories/32095Third Party Advisory
- http://secunia.com/advisories/32096Third Party Advisory
- http://secunia.com/advisories/32144Third Party Advisory
- http://secunia.com/advisories/32185Third Party Advisory
- http://secunia.com/advisories/32196Third Party Advisory
- http://secunia.com/advisories/32845Third Party Advisory
- http://secunia.com/advisories/33433Third Party Advisory
- http://secunia.com/advisories/33434Third Party Advisory
- http://secunia.com/advisories/34501Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
- http://www.0x000000.com/?i=422Third Party Advisory
- http://www.debian.org/security/2008/dsa-1649Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.