vulnwire
7.5high

CVE-2008-4058

The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 a…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.1%
percentile 92%
Public exploits
0
none known

The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to (1) chrome XBL and (2) chrome JS.

Exploit prediction (EPSS)

5.08% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • secunia.com /advisories/32025 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32011 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • slackware.com /security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232 · vendor-advisory, x_refsource_SLACKWARE, x_transferred
  • debian.org /security/2009/dsa-1697 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/32096 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /archives/fedora-package-announce/2008-September/msg01384.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • ubuntu.com /usn/usn-645-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/45349 · vdb-entry, x_refsource_XF, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:206 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • secunia.com /advisories/32144 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32010 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • mozilla.org /security/announce/2008/mfsa2008-41.html · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2009/0977 · vdb-entry, x_refsource_VUPEN, x_transferred
  • ubuntu.com /usn/usn-645-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • securityfocus.com /bid/31346 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/31985 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-10/msg00005.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • secunia.com /advisories/31984 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32185 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32196 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /archives/fedora-package-announce/2008-September/msg01335.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • debian.org /security/2008/dsa-1669 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/32042 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/33433 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/2661 · vdb-entry, x_refsource_VUPEN, x_transferred
  • slackware.com /security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422 · vendor-advisory, x_refsource_SLACKWARE, x_transferred
  • secunia.com /advisories/32095 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32089 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-256408-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • secunia.com /advisories/32092 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /support/errata/RHSA-2008-0879.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:205 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • debian.org /security/2009/dsa-1696 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • download.novell.com /Download?buildid=WZXONb-tqBw~ · x_refsource_CONFIRM, x_transferred
  • redhat.com /archives/fedora-package-announce/2008-September/msg01403.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • secunia.com /advisories/31987 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9679 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securitytracker.com /id?1020915 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • ubuntu.com /usn/usn-647-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/32007 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32012 · Third Party Advisory
  • secunia.com /advisories/32044 · Third Party Advisory
  • secunia.com /advisories/32082 · Third Party Advisory
  • secunia.com /advisories/32845 · Third Party Advisory
  • secunia.com /advisories/33434 · Third Party Advisory
  • secunia.com /advisories/34501 · Third Party Advisory
  • slackware.com /security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123 · Third Party Advisory
  • debian.org /security/2008/dsa-1649 · Third Party Advisory
  • redhat.com /support/errata/RHSA-2008-0882.html · Third Party Advisory
  • redhat.com /support/errata/RHSA-2008-0908.html · Third Party Advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.