CVE-2008-3837 — Mozilla Firefox vulnerability

8 documents6 sources
Severity
9.3CRITICALNVD
CNA7.5
EPSS
3.7%
top 12.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla SeamonkeyCanonical Ubuntu Linux+1 more
Timeline
PublishedSep 24
Latest updateMay 2

Description

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDmozilla/firefox3.0 — 3.0.2+1
▶NVDmozilla/seamonkey< 1.1.12

Also affects: Debian Linux 4.0, Ubuntu Linux 6.06, 7.04, 7.10, 8.04

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-w2pf-f3c3-85m7: Mozilla Firefox before 2↗2022-05-02
▶
CVEList
CVE-2008-3837: Mozilla Firefox before 2↗2008-09-24
▶

📋Vendor Advisories

4
Ubuntu
Firefox and xulrunner regression↗2008-09-25
▶
Ubuntu
Firefox vulnerabilities↗2008-09-24
▶
Ubuntu
Firefox and xulrunner vulnerabilities↗2008-09-24
▶
Red Hat
mozilla: Forced mouse drag↗2008-09-23
▶

💬Community

1
Bugzilla
CVE-2008-3837 mozilla: Forced mouse drag↗2008-09-22
▶
CVE-2008-3837 — Mozilla Firefox vulnerability | cvebase