CVE-2008-5913
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for…
Does this matter?
Lower severity and a low EPSS score (1.14%). Track it; it rarely justifies an emergency change on its own.
Description
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
- CVSS 2.0
- 4.9 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
- EPSS
- 1.14% probability · 65th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox · mozilla/seamonkey
- Source
- cve@mitre.org
References
- http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html
- http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
- http://secunia.com/advisories/40326
- http://secunia.com/advisories/40401
- http://secunia.com/advisories/40481
- http://support.avaya.com/css/P8/documents/100091069
- http://ubuntu.com/usn/usn-930-1
- http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161
- http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:125
- http://www.mozilla.org/security/announce/2010/mfsa2010-33.html
- http://www.redhat.com/support/errata/RHSA-2010-0500.html
- http://www.redhat.com/support/errata/RHSA-2010-0501.html
- http://www.securityfocus.com/bid/33276
- http://www.trusteer.com/files/In-session-phishing-advisory-2.pdf
- http://www.ubuntu.com/usn/usn-930-2
- http://www.vupen.com/english/advisories/2010/1551
- http://www.vupen.com/english/advisories/2010/1557
- http://www.vupen.com/english/advisories/2010/1592
- http://www.vupen.com/english/advisories/2010/1640
- http://www.vupen.com/english/advisories/2010/1773
- https://bugzilla.mozilla.org/show_bug.cgi?id=475585
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11139
- http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html
- http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
- http://secunia.com/advisories/40326
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.