Published: 15/10/2008 Updated: 30/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Mozilla Firefox 3.0.1 up to and including 3.0.3, Firefox 2.x prior to 2.0.0.18, and SeaMonkey 1.x prior to 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote malicious users to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 4.0
mozilla firefox 3.0.2
mozilla firefox 3.0.1
mozilla firefox 3.0.3
mozilla firefox 2.0.0.14
mozilla firefox 2.0.0.15
mozilla firefox 2.0.0.12
mozilla firefox 2.0.0.13
mozilla firefox 2.0
mozilla firefox 2.0.0.1
mozilla firefox 2.0.0.16
mozilla firefox 2.0.0.17
mozilla firefox 2.0.0.10
mozilla firefox 2.0.0.11
canonical ubuntu linux 8.04
canonical ubuntu linux 6.06
canonical ubuntu linux 8.10
canonical ubuntu linux 7.10
mozilla seamonkey 1.0.5
mozilla seamonkey 1.0.4
mozilla seamonkey 1.1
mozilla seamonkey 1.1.1
mozilla seamonkey 1.1.9
mozilla seamonkey 1.0.8
mozilla seamonkey 1.0.7
mozilla seamonkey 1.0.6
mozilla seamonkey 1.0
mozilla seamonkey 1.1.4
mozilla seamonkey 1.1.3
mozilla seamonkey 1.1.2
mozilla seamonkey 1.0.3
mozilla seamonkey 1.0.2
mozilla seamonkey 1.1.10
mozilla seamonkey 1.1.11
mozilla seamonkey 1.1.8
mozilla seamonkey 1.1.7
mozilla seamonkey 1.0.9
mozilla seamonkey 1.0.1
mozilla seamonkey 1.1.12
mozilla seamonkey 1.1.6
mozilla seamonkey 1.1.5

Liu Die Yu discovered an information disclosure vulnerability in Firefox when using saved url shortcut files If a user were tricked into downloading a crafted url file and a crafted HTML file, an attacker could steal information from the user’s cache (CVE-2008-4582) ...

Several remote vulnerabilities have been discovered in the Iceweasel webbrowser, an unbranded version of the Firefox browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0017 Justin Schuh discovered that a buffer overflow in the http-index-format parser could lead to arbitrary code execution ...

Several remote vulnerabilities have been discovered in Iceape an unbranded version of the Seamonkey internet suite The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the ex ...

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the executio ...

Mozilla Foundation Security Advisory 2008-47 Information stealing via local shortcut files Announced November 12, 2008 Reporter Liu Die Yu Impact Moderate Products Firefox, SeaMonkey Fixed in ...

source: wwwsecurityfocuscom/bid/31611/info Mozilla Firefox is prone to a vulnerability that allows attackers to violate the same-origin policy This issue occurs because the application fails to properly enforce the same-origin policy when handling internet shortcut files An attacker may create a malicious webpage that can access the pr ...

CVE-2008-4582

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect