CVE-2008-5503
published 2008-12-17CVE-2008-5503: The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any…
PriorityP410low2.6CVSS 2.0
AVNACHAuNCPINAN
EPSS
1.52%
71.8th percentile
The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 2.0.0.18 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | seamonkey | <= 1.1.13 | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
vendor_ubuntu10.0CRITICAL
vendor_redhat2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2009-01-06·CVSS 10.0
CVE-2008-5500 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Thunderbird vulnerabilities
Several flaws were discovered in the browser engine. If a user had Javascript
enabled, these problems could allow an attacker to crash Thunderbird and
possibly execute arbitrary code with user privileges. (CVE-2008-5500)
Boris Zbarsky discovered that the same-origin check in Thunderbird could be
bypassed by utilizing XBL-bindings. If a user had Javascript enabled, an
attacker could exploit this to read data from other domains. (CVE-2008-5503)
Marius Schilder discovered that Thunderbird did not properly handle redirects
to an outside domain when an XMLHttpRequest was made to a same-origin resource.
When Javascript is enabled, it's possible that sensitive information could be
revealed in the XMLHttpRequest response.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2009-01-06·CVSS 10.0
CVE-2008-5500 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Thunderbird vulnerabilities
Several flaws were discovered in the browser engine. If a user had Javascript
enabled, these problems could allow an attacker to crash Thunderbird and
possibly execute arbitrary code with user privileges. (CVE-2008-5500)
Boris Zbarsky discovered that the same-origin check in Thunderbird could be
bypassed by utilizing XBL-bindings. If a user had Javascript enabled, an
attacker could exploit this to read data from other domains. (CVE-2008-5503)
Marius Schilder discovered that Thunderbird did not properly handle redirects
to an outside domain when an XMLHttpRequest was made to a same-origin resource.
When Javascript is enabled, it's possible that sensitive information could be
revealed in the XMLHttpRequest response.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2008-12-18·CVSS 10.0
CVE-2008-5503 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox vulnerabilities
Several flaws were discovered in the browser engine. These problems could allow
an attacker to crash the browser and possibly execute arbitrary code with user
privileges. (CVE-2008-5500)
Boris Zbarsky discovered that the same-origin check in Firefox could be
bypassed by utilizing XBL-bindings. An attacker could exploit this to read data
from other domains. (CVE-2008-5503)
Marius Schilder discovered that Firefox did not properly handle redirects to
an outside domain when an XMLHttpRequest was made to a same-origin resource.
It's possible that sensitive information could be revealed in the
XMLHttpRequest response. (CVE-2008-5506)
Chris Evans discovered that Firefox did not properly protect a user's data when
accessing a sam
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2008-12-18·CVSS 10.0
CVE-2008-5510 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox vulnerabilities
Several flaws were discovered in the browser engine. These problems could allow
an attacker to crash the browser and possibly execute arbitrary code with user
privileges. (CVE-2008-5500)
Boris Zbarsky discovered that the same-origin check in Firefox could be
bypassed by utilizing XBL-bindings. An attacker could exploit this to read data
from other domains. (CVE-2008-5503)
Several problems were discovered in the JavaScript engine. An attacker could
exploit feed preview vulnerabilities to execute scripts from page content with
chrome privileges. (CVE-2008-5504)
Marius Schilder discovered that Firefox did not properly handle redirects to
an outside domain when an XMLHttpRequest was made to a same-origin resource.
It's possib
Red Hat
Firefox 2 Information stealing via loadBindingDocument
vendor_redhat·2008-12-16·CVSS 2.6
CVE-2008-5503 [LOW] Firefox 2 Information stealing via loadBindingDocument
Firefox 2 Information stealing via loadBindingDocument
The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.
GHSA
GHSA-xmfc-3wmp-72qq: The loadBindingDocument function in Mozilla Firefox 2
ghsa_unreviewed·2022-05-14
CVE-2008-5503 [LOW] GHSA-xmfc-3wmp-72qq: The loadBindingDocument function in Mozilla Firefox 2
The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.
No detection rules found.
No public exploits indexed.
http://secunia.com/advisories/33184http://secunia.com/advisories/33189http://secunia.com/advisories/33204http://secunia.com/advisories/33205http://secunia.com/advisories/33231http://secunia.com/advisories/33232http://secunia.com/advisories/33408http://secunia.com/advisories/33415http://secunia.com/advisories/33421http://secunia.com/advisories/33433http://secunia.com/advisories/33434http://secunia.com/advisories/33523http://secunia.com/advisories/33547http://secunia.com/advisories/34501http://secunia.com/advisories/35080http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1http://www.debian.org/security/2009/dsa-1696http://www.debian.org/security/2009/dsa-1697http://www.debian.org/security/2009/dsa-1704http://www.debian.org/security/2009/dsa-1707http://www.mandriva.com/security/advisories?name=MDVSA-2008:244http://www.mandriva.com/security/advisories?name=MDVSA-2009:012http://www.mozilla.org/security/announce/2008/mfsa2008-61.htmlhttp://www.redhat.com/support/errata/RHSA-2008-1037.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0002.htmlhttp://www.securityfocus.com/bid/32882http://www.securitytracker.com/id?1021424http://www.ubuntu.com/usn/usn-690-2http://www.ubuntu.com/usn/usn-701-1http://www.ubuntu.com/usn/usn-701-2http://www.vupen.com/english/advisories/2009/0977https://bugzilla.mozilla.org/show_bug.cgi?id=379959https://exchange.xforce.ibmcloud.com/vulnerabilities/47409https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11423https://usn.ubuntu.com/690-3/http://secunia.com/advisories/33184http://secunia.com/advisories/33189http://secunia.com/advisories/33204http://secunia.com/advisories/33205http://secunia.com/advisories/33231http://secunia.com/advisories/33232http://secunia.com/advisories/33408http://secunia.com/advisories/33415http://secunia.com/advisories/33421http://secunia.com/advisories/33433http://secunia.com/advisories/33434http://secunia.com/advisories/33523http://secunia.com/advisories/33547http://secunia.com/advisories/34501http://secunia.com/advisories/35080http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1http://www.debian.org/security/2009/dsa-1696http://www.debian.org/security/2009/dsa-1697http://www.debian.org/security/2009/dsa-1704http://www.debian.org/security/2009/dsa-1707http://www.mandriva.com/security/advisories?name=MDVSA-2008:244http://www.mandriva.com/security/advisories?name=MDVSA-2009:012http://www.mozilla.org/security/announce/2008/mfsa2008-61.htmlhttp://www.redhat.com/support/errata/RHSA-2008-1037.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0002.htmlhttp://www.securityfocus.com/bid/32882http://www.securitytracker.com/id?1021424http://www.ubuntu.com/usn/usn-690-2http://www.ubuntu.com/usn/usn-701-1http://www.ubuntu.com/usn/usn-701-2http://www.vupen.com/english/advisories/2009/0977https://bugzilla.mozilla.org/show_bug.cgi?id=379959https://exchange.xforce.ibmcloud.com/vulnerabilities/47409https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11423https://usn.ubuntu.com/690-3/
2008-12-17
Published