CVE-2008-5023
HIGH severity · CVSS 7.5 · Improper input validation
7.5CVSS HIGH
Summary
Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)3%
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlAdvisory
- http://secunia.com/advisories/32684Advisory
- http://secunia.com/advisories/32693Advisory
- http://secunia.com/advisories/32694Advisory
- http://secunia.com/advisories/32695Advisory
- http://secunia.com/advisories/32713Advisory
- http://secunia.com/advisories/32714Advisory
- http://secunia.com/advisories/32721Advisory