VulnerabilityModified

CVE-2008-4582

MEDIUM 4.3EPSS 10.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 10.2%, higher than 95% of all known CVEs. Patch or mitigate before the next change window.

Description

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS: 10.19% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: debian/debian linux · mozilla/firefox · canonical/ubuntu linux · mozilla/seamonkey
Source: cve@mitre.org

References

http://liudieyu0.blog124.fc2.com/blog-entry-6.htmlBroken Link
http://secunia.com/advisories/32192Permissions Required, Third Party Advisory
http://secunia.com/advisories/32684Permissions Required, Third Party Advisory
http://secunia.com/advisories/32693Permissions Required, Third Party Advisory
http://secunia.com/advisories/32714Permissions Required, Third Party Advisory
http://secunia.com/advisories/32721Permissions Required, Third Party Advisory
http://secunia.com/advisories/32778Permissions Required, Third Party Advisory
http://secunia.com/advisories/32845Permissions Required, Third Party Advisory
http://secunia.com/advisories/32853Permissions Required, Third Party Advisory
http://secunia.com/advisories/33433Permissions Required, Third Party Advisory
http://secunia.com/advisories/33434Permissions Required, Third Party Advisory
http://secunia.com/advisories/34501Permissions Required, Third Party Advisory
http://securityreason.com/securityalert/4416Third Party Advisory
http://securitytracker.com/alerts/2008/Nov/1021212.htmlThird Party Advisory, VDB Entry
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
http://ubuntu.com/usn/usn-667-1Third Party Advisory
http://www.debian.org/security/2008/dsa-1669Third Party Advisory
http://www.debian.org/security/2008/dsa-1671Third Party Advisory
http://www.debian.org/security/2009/dsa-1696Third Party Advisory
http://www.debian.org/security/2009/dsa-1697Third Party Advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-47.htmlVendor Advisory
http://www.securityfocus.com/archive/1/497091/100/0/threaded
http://www.securityfocus.com/bid/31611Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/31747Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1021190Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-319A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/2818Not Applicable
http://www.vupen.com/english/advisories/2009/0977Not Applicable
https://bugzilla.mozilla.org/show_bug.cgi?id=455311Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/45740

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.