CVE-2008-0413
published 2008-02-08CVE-2008-0413: The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of…
PriorityP427critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
2.48%
82.8th percentile
The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1) a large switch statement, (2) certain uses of watch and eval, (3) certain uses of the mousedown event listener, and other vectors.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 2.0.0.11 | — |
| mozilla | seamonkey | <= 1.1.7 | — |
| mozilla | thunderbird | <= 2.0.0.11 | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird regression
vendor_ubuntu·2008-03-06·CVSS 7.5
[HIGH] Thunderbird regression
Title: Thunderbird regression
Summary: Thunderbird regression
USN-582-1 fixed several vulnerabilities in Thunderbird. The upstream
fixes were incomplete, and after performing certain actions Thunderbird
would crash due to memory errors. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Thunderbird did not properly set the size of a
buffer when parsing an external-body MIME-type. If a user were to open
a specially crafted email, an attacker could cause a denial of service
via application crash or possibly execute arbitrary code as the user.
(CVE-2008-0304)
Various flaws were discovered in Thunderbird and its JavaScript
engine. By tricking a user into opening a malicious message, an
attacker could execute arbitrary code
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2008-02-29·CVSS 7.5
CVE-2008-0304 [HIGH] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Thunderbird vulnerabilities
It was discovered that Thunderbird did not properly set the size of a
buffer when parsing an external-body MIME-type. If a user were to open
a specially crafted email, an attacker could cause a denial of service
via application crash or possibly execute arbitrary code as the user.
(CVE-2008-0304)
Various flaws were discovered in Thunderbird and its JavaScript
engine. By tricking a user into opening a malicious message, an
attacker could execute arbitrary code with the user's privileges.
(CVE-2008-0412, CVE-2008-0413)
Various flaws were discovered in the JavaScript engine. By tricking
a user into opening a malicious message, an attacker could escalate
privileges within Thunderbird, perform cross-site scripting attac
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2008-02-08·CVSS 9.3
CVE-2008-0412 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox vulnerabilities
Various flaws were discovered in the browser and JavaScript engine.
By tricking a user into opening a malicious web page, an attacker
could execute arbitrary code with the user's privileges.
(CVE-2008-0412, CVE-2008-0413)
Flaws were discovered in the file upload form control. A malicious
website could force arbitrary files from the user's computer to be
uploaded without consent. (CVE-2008-0414)
Various flaws were discovered in the JavaScript engine. By tricking
a user into opening a malicious web page, an attacker could escalate
privileges within the browser, perform cross-site scripting attacks
and/or execute arbitrary code with the user's privileges. (CVE-2008-0415)
Various flaws were discovered in character encoding ha
Red Hat
Mozilla javascript engine crashes
vendor_redhat·2008-02-07·CVSS 9.3
CVE-2008-0413 [CRITICAL] Mozilla javascript engine crashes
Mozilla javascript engine crashes
The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1) a large switch statement, (2) certain uses of watch and eval, (3) certain uses of the mousedown event listener, and other vectors.
GHSA
GHSA-mx7q-m4p3-672f: The JavaScript engine in Mozilla Firefox before 2
ghsa_unreviewed·2022-05-01
CVE-2008-0413 [HIGH] GHSA-mx7q-m4p3-672f: The JavaScript engine in Mozilla Firefox before 2
The JavaScript engine in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via (1) a large switch statement, (2) certain uses of watch and eval, (3) certain uses of the mousedown event listener, and other vectors.
No detection rules found.
No public exploits indexed.
http://browser.netscape.com/releasenotes/http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.htmlhttp://secunia.com/advisories/28754http://secunia.com/advisories/28758http://secunia.com/advisories/28766http://secunia.com/advisories/28808http://secunia.com/advisories/28815http://secunia.com/advisories/28818http://secunia.com/advisories/28839http://secunia.com/advisories/28864http://secunia.com/advisories/28865http://secunia.com/advisories/28877http://secunia.com/advisories/28879http://secunia.com/advisories/28924http://secunia.com/advisories/28939http://secunia.com/advisories/28958http://secunia.com/advisories/29049http://secunia.com/advisories/29086http://secunia.com/advisories/29098http://secunia.com/advisories/29164http://secunia.com/advisories/29167http://secunia.com/advisories/29211http://secunia.com/advisories/30327http://secunia.com/advisories/30620http://secunia.com/advisories/31043http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.445399http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1http://wiki.rpath.com/Advisories:rPSA-2008-0051http://wiki.rpath.com/Advisories:rPSA-2008-0093http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093http://www.debian.org/security/2008/dsa-1484http://www.debian.org/security/2008/dsa-1485http://www.debian.org/security/2008/dsa-1489http://www.debian.org/security/2008/dsa-1506http://www.gentoo.org/security/en/glsa/glsa-200805-18.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:048http://www.mandriva.com/security/advisories?name=MDVSA-2008:062http://www.mozilla.org/security/announce/2008/mfsa2008-01.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0103.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0104.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0105.htmlhttp://www.securityfocus.com/archive/1/487826/100/0/threadedhttp://www.securityfocus.com/archive/1/488002/100/0/threadedhttp://www.securityfocus.com/archive/1/488971/100/0/threadedhttp://www.securityfocus.com/bid/27683http://www.securitytracker.com/id?1019321http://www.ubuntu.com/usn/usn-576-1http://www.ubuntu.com/usn/usn-582-1http://www.ubuntu.com/usn/usn-582-2http://www.vupen.com/english/advisories/2008/0453/referenceshttp://www.vupen.com/english/advisories/2008/0454/referenceshttp://www.vupen.com/english/advisories/2008/0627/referenceshttp://www.vupen.com/english/advisories/2008/1793/referenceshttp://www.vupen.com/english/advisories/2008/2091/referenceshttps://bugzilla.mozilla.org/buglist.cgi?bug_id=407720%2C390597%2C373344%2C398085%2C406572%2C391028%2C406036%2C402087https://issues.rpath.com/browse/RPL-1995https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10385https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00905.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00946.htmlhttp://browser.netscape.com/releasenotes/http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.htmlhttp://secunia.com/advisories/28754http://secunia.com/advisories/28758http://secunia.com/advisories/28766http://secunia.com/advisories/28808http://secunia.com/advisories/28815http://secunia.com/advisories/28818http://secunia.com/advisories/28839http://secunia.com/advisories/28864http://secunia.com/advisories/28865http://secunia.com/advisories/28877http://secunia.com/advisories/28879http://secunia.com/advisories/28924http://secunia.com/advisories/28939http://secunia.com/advisories/28958http://secunia.com/advisories/29049http://secunia.com/advisories/29086http://secunia.com/advisories/29098http://secunia.com/advisories/29164http://secunia.com/advisories/29167http://secunia.com/advisories/29211http://secunia.com/advisories/30327http://secunia.com/advisories/30620http://secunia.com/advisories/31043http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.445399http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1http://wiki.rpath.com/Advisories:rPSA-2008-0051http://wiki.rpath.com/Advisories:rPSA-2008-0093http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093http://www.debian.org/security/2008/dsa-1484http://www.debian.org/security/2008/dsa-1485http://www.debian.org/security/2008/dsa-1489http://www.debian.org/security/2008/dsa-1506http://www.gentoo.org/security/en/glsa/glsa-200805-18.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:048
+ 26 more references
2008-02-08
Published