VulnerabilityModified

CVE-2008-5024

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection…

HIGH 7.5EPSS 3.64%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.64%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 3.64% probability · 89th percentile
CISA KEV: Not listed
Weakness: CWE-91
Affected: mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · debian/debian linux · canonical/ubuntu linux
Source: secalert@redhat.com

References

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlThird Party Advisory
http://secunia.com/advisories/32684Third Party Advisory
http://secunia.com/advisories/32693Third Party Advisory
http://secunia.com/advisories/32694Third Party Advisory
http://secunia.com/advisories/32695Third Party Advisory
http://secunia.com/advisories/32713Third Party Advisory
http://secunia.com/advisories/32714Third Party Advisory
http://secunia.com/advisories/32715Third Party Advisory
http://secunia.com/advisories/32721Third Party Advisory
http://secunia.com/advisories/32778Third Party Advisory
http://secunia.com/advisories/32798Third Party Advisory
http://secunia.com/advisories/32845Third Party Advisory
http://secunia.com/advisories/32853Third Party Advisory
http://secunia.com/advisories/33433Third Party Advisory
http://secunia.com/advisories/33434Third Party Advisory
http://secunia.com/advisories/34501Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
http://ubuntu.com/usn/usn-667-1Third Party Advisory
http://www.debian.org/security/2008/dsa-1669Third Party Advisory
http://www.debian.org/security/2008/dsa-1671Third Party Advisory
http://www.debian.org/security/2009/dsa-1696Third Party Advisory
http://www.debian.org/security/2009/dsa-1697Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:228Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:230Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:235Third Party Advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-58.htmlVendor Advisory
http://www.redhat.com/support/errata/RHSA-2008-0976.htmlThird Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0977.htmlThird Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0978.htmlThird Party Advisory
http://www.securityfocus.com/bid/32281Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.