CVE-2008-5023 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation6 documents6 sources
Severity
7.5HIGHNVD
EPSS
18.4%
top 4.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla SeamonkeyCanonical Ubuntu Linux+1 more
Timeline
PublishedNov 13
Latest updateMay 14

Description

Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDmozilla/firefox2.0 — 2.0.0.18+1
▶NVDmozilla/seamonkey1.0 — 1.1.13

Also affects: Debian Linux 4.0, Ubuntu Linux 6.06, 7.10, 8.04, 8.10

🔴Vulnerability Details

2
GHSA
GHSA-w4jm-xq46-3m5g: Firefox 3↗2022-05-14
▶
CVEList
CVE-2008-5023: Firefox 3↗2008-11-13
▶

📋Vendor Advisories

2
Ubuntu
Firefox and xulrunner vulnerabilities↗2008-11-17
▶
Red Hat
Mozilla -moz-binding property bypasses security checks on codebase principals↗2008-11-12
▶

💬Community

1
Bugzilla
CVE-2008-5023 Mozilla -moz-binding property bypasses security checks on codebase principals↗2008-11-10
▶
CVE-2008-5023 — Improper Input Validation in Mozilla | cvebase