Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2008-0017

Published: 13/11/2008 Updated: 26/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 828
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Firefox

Vulnerability Summary

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, and SeaMonkey 1.x prior to 1.1.13 does not check for an allocation failure, which allows remote malicious users to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.

Vulnerable Product Search on Vulmon Subscribe to Product

mozilla firefox

mozilla seamonkey

canonical ubuntu linux 8.10

canonical ubuntu linux 8.04

canonical ubuntu linux 7.10

canonical ubuntu linux 6.06

debian debian linux 4.0

debian debian linux 5.0

Vendor Advisories

Ubuntu Security Notice: firefox, firefox-3.0, xulrunner-1.9 vulnerabilities
Liu Die Yu discovered an information disclosure vulnerability in Firefox when using saved url shortcut files If a user were tricked into downloading a crafted url file and a crafted HTML file, an attacker could steal information from the user’s cache (CVE-2008-4582) ...
Red Hat: Critical: firefox security update
Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An updated firefox package that fixes various security issues is nowavailable for Red Hat Enterprise Linux 4 and 5This update has been rated as having critical security impact by the RedHat Security Response Team ...
Red Hat: Critical: seamonkey security update
Synopsis Critical: seamonkey security update Type/Severity Security Advisory: Critical Topic Updated seamonkey packages that fix security issues are now available forRed Hat Enterprise Linux 21, Red Hat Enterprise Linux 3 and Red HatEnterprise Linux 4This update has been rated as having critical security ...
Debian Security Advisories: DSA-1671-1 iceweasel -- several vulnerabilities
Several remote vulnerabilities have been discovered in the Iceweasel webbrowser, an unbranded version of the Firefox browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0017 Justin Schuh discovered that a buffer overflow in the http-index-format parser could lead to arbitrary code execution ...
Debian Security Advisories: DSA-1697-1 iceape -- several vulnerabilities
Several remote vulnerabilities have been discovered in Iceape an unbranded version of the Seamonkey internet suite The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the ex ...
Debian Security Advisories: DSA-1669-1 xulrunner -- several vulnerabilities
Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the executio ...
Mozilla: Buffer overflow in http-index-format parser
Mozilla Foundation Security Advisory 2008-54 Buffer overflow in http-index-format parser Announced November 12, 2008 Reporter Justin Schuh Impact Critical Products Firefox, SeaMonkey Fixed in ...

References

CWE-119https://bugzilla.mozilla.org/show_bug.cgi?id=443299http://www.mozilla.org/security/announce/2008/mfsa2008-54.htmlhttp://www.iss.net/threats/311.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:228http://www.securityfocus.com/bid/32281https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.htmlhttp://secunia.com/advisories/32721http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlhttp://www.us-cert.gov/cas/techalerts/TA08-319A.htmlhttp://secunia.com/advisories/32845http://www.debian.org/security/2008/dsa-1669http://secunia.com/advisories/32693http://www.redhat.com/support/errata/RHSA-2008-0978.htmlhttp://secunia.com/advisories/32694http://secunia.com/advisories/32714http://secunia.com/advisories/32695http://www.redhat.com/support/errata/RHSA-2008-0977.htmlhttp://www.debian.org/security/2008/dsa-1671http://www.debian.org/security/2009/dsa-1697http://secunia.com/advisories/33433http://secunia.com/advisories/34501http://www.vupen.com/english/advisories/2009/0977http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1http://www.securitytracker.com/id?1021185http://www.vupen.com/english/advisories/2008/3146http://secunia.com/advisories/32684http://www.mandriva.com/security/advisories?name=MDVSA-2008:230http://secunia.com/advisories/32713http://ubuntu.com/usn/usn-667-1http://secunia.com/advisories/32853https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.htmlhttp://secunia.com/advisories/32778https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11005https://usn.ubuntu.com/667-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
man-in-the-middleCVE-2024-34558CVE-2024-32674CVE-2024-34351XPath injectionCVE-2023-45866CVE-2024-25528CVE-2024-25517path traversal
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook