CVE-2008-4068
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:C/I:N/A:N
- EPSS
- 4.17% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · debian/debian linux · canonical/ubuntu linux
- Source
- secalert@redhat.com
References
- http://download.novell.com/Download?buildid=WZXONb-tqBw~Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.htmlThird Party Advisory
- http://secunia.com/advisories/31984Third Party Advisory
- http://secunia.com/advisories/31985Third Party Advisory
- http://secunia.com/advisories/31987Third Party Advisory
- http://secunia.com/advisories/32007Third Party Advisory
- http://secunia.com/advisories/32010Third Party Advisory
- http://secunia.com/advisories/32011Third Party Advisory
- http://secunia.com/advisories/32012Third Party Advisory
- http://secunia.com/advisories/32025Third Party Advisory
- http://secunia.com/advisories/32042Third Party Advisory
- http://secunia.com/advisories/32044Third Party Advisory
- http://secunia.com/advisories/32082Third Party Advisory
- http://secunia.com/advisories/32089Third Party Advisory
- http://secunia.com/advisories/32092Third Party Advisory
- http://secunia.com/advisories/32095Third Party Advisory
- http://secunia.com/advisories/32096Third Party Advisory
- http://secunia.com/advisories/32144Third Party Advisory
- http://secunia.com/advisories/32185Third Party Advisory
- http://secunia.com/advisories/32196Third Party Advisory
- http://secunia.com/advisories/32845Third Party Advisory
- http://secunia.com/advisories/33433Third Party Advisory
- http://secunia.com/advisories/33434Third Party Advisory
- http://secunia.com/advisories/34501Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232Third Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
- http://www.debian.org/security/2008/dsa-1649Third Party Advisory
- http://www.debian.org/security/2008/dsa-1669Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.