CVE-2008-0017 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents6 sources
Severity
9.3CRITICALNVD
EPSS
14.5%
top 5.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla SeamonkeyCanonical Ubuntu Linux+1 more
Timeline
PublishedNov 13
Latest updateMay 1

Description

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDmozilla/firefox2.0 — 2.0.0.18+1
▶NVDmozilla/seamonkey1.0 — 1.1.13

Also affects: Debian Linux 4.0, 5.0, Ubuntu Linux 6.06, 7.10, 8.04, 8.10

🔴Vulnerability Details

2
GHSA
GHSA-4386-5g32-qp3p: The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3↗2022-05-01
▶
CVEList
CVE-2008-0017: The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3↗2008-11-13
▶

📋Vendor Advisories

2
Ubuntu
Firefox and xulrunner vulnerabilities↗2008-11-17
▶
Red Hat
Mozilla buffer overflow in http-index-format parser↗2008-11-12
▶

💬Community

1
Bugzilla
CVE-2008-0017 Mozilla buffer overflow in http-index-format parser↗2008-11-10
▶
CVE-2008-0017 — Mozilla Firefox vulnerability | cvebase