4.3
CVSSv2

CVE-2008-5508

Published: 17/12/2008 Updated: 08/11/2018
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

Mozilla Firefox 3.x prior to 3.0.5 and 2.x prior to 2.0.0.19, Thunderbird 2.x prior to 2.0.0.19, and SeaMonkey 1.x prior to 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote malicious users to misrepresent URLs and simplify phishing attacks.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

mozilla thunderbird

mozilla firefox

mozilla seamonkey

canonical ubuntu linux 6.06

canonical ubuntu linux 7.10

canonical ubuntu linux 8.04

canonical ubuntu linux 8.10

debian debian linux 5.0

debian debian linux 4.0

Vendor Advisories

Synopsis Moderate: thunderbird security update Type/Severity Security Advisory: Moderate Topic Updated thunderbird packages that fix several security issues are nowavailable for Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Tea ...
Synopsis Critical: seamonkey security update Type/Severity Security Advisory: Critical Topic Updated seamonkey packages that fix security issues are now available forRed Hat Enterprise Linux 21, Red Hat Enterprise Linux 3, and Red HatEnterprise Linux 4This update has been rated as having critical security ...
Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An updated firefox package that fixes various security issues is nowavailable for Red Hat Enterprise Linux 4 and 5This update has been rated as having critical security impact by the RedHat Security Response Team ...
Several flaws were discovered in the browser engine If a user had Javascript enabled, these problems could allow an attacker to crash Thunderbird and possibly execute arbitrary code with user privileges (CVE-2008-5500) ...
Several flaws were discovered in the browser engine These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges (CVE-2008-5500, CVE-2008-5501, CVE-2008-5502) ...
Several flaws were discovered in the browser engine If a user had Javascript enabled, these problems could allow an attacker to crash Thunderbird and possibly execute arbitrary code with user privileges (CVE-2008-5500) ...
Several flaws were discovered in the browser engine These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges (CVE-2008-5500) ...
Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-5500 Jesse Ruderman discovered that the layout engine is vulnerable to DoS attacks that might trigger memory corruption and an integer ov ...
Several remote vulnerabilities have been discovered in Iceape an unbranded version of the Seamonkey internet suite The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0016 Justin Schuh, Tom Cross and Peter Williams discovered a buffer overflow in the parser for UTF-8 URLs, which may lead to the ex ...
Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-5500 Jesse Ruderman discovered that the layout engine is vulnerable to DoS attacks that might trigger memory corruption and ...
Mozilla Foundation Security Advisory 2008-66 Errors parsing URLs with leading whitespace and control characters Announced December 16, 2008 Reporter Chip Salzenberg Impact Low Products Firefox, SeaMonkey, Thunderbird Fi ...

References

CWE-20https://bugzilla.mozilla.org/show_bug.cgi?id=425046https://bugzilla.mozilla.org/show_bug.cgi?id=460803http://www.mozilla.org/security/announce/2008/mfsa2008-66.htmlhttp://secunia.com/advisories/33231http://www.debian.org/security/2009/dsa-1697http://secunia.com/advisories/33433http://secunia.com/advisories/33523http://secunia.com/advisories/33204http://www.mandriva.com/security/advisories?name=MDVSA-2009:012http://www.securitytracker.com/id?1021426http://secunia.com/advisories/33203http://secunia.com/advisories/33205http://www.redhat.com/support/errata/RHSA-2008-1036.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:245http://secunia.com/advisories/33184http://www.redhat.com/support/errata/RHSA-2008-1037.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:244http://www.securityfocus.com/bid/32882http://secunia.com/advisories/33216http://www.ubuntu.com/usn/usn-690-2http://secunia.com/advisories/33188http://secunia.com/advisories/33547http://secunia.com/advisories/33189http://www.debian.org/security/2009/dsa-1707http://www.debian.org/security/2009/dsa-1704http://secunia.com/advisories/33421http://secunia.com/advisories/33434http://www.redhat.com/support/errata/RHSA-2009-0002.htmlhttp://www.debian.org/security/2009/dsa-1696http://secunia.com/advisories/34501http://www.vupen.com/english/advisories/2009/0977http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1http://secunia.com/advisories/35080http://www.ubuntu.com/usn/usn-701-2http://www.ubuntu.com/usn/usn-701-1http://secunia.com/advisories/33408http://secunia.com/advisories/33415https://exchange.xforce.ibmcloud.com/vulnerabilities/47414https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11040https://usn.ubuntu.com/690-1/https://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2009:0002https://usn.ubuntu.com/701-1/