CVE-2008-0017

Published: Nov 13, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.

Affected (9)

Products: Mozilla: Firefox, Seamonkey · Canonical: Ubuntu Linux · Debian: Debian Linux

2 products

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	From 2.0 to 2.0.0.18
Mozilla Firefox	From 3.0 to 3.0.4
Mozilla Seamonkey	From 1.0 to 1.1.13

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (66)

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32684

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32693

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32694

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32695

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32713

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32714

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32721

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32778

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32845

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32853

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/33433

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/34501

Source: cve@mitre.org

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1

Source: cve@mitre.org

Broken Link

http://ubuntu.com/usn/usn-667-1

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1669

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1671

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2009/dsa-1697

Source: cve@mitre.org

Third Party Advisory

http://www.iss.net/threats/311.html

Source: cve@mitre.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2008:228

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:230

Source: cve@mitre.org

Third Party Advisory

http://www.mozilla.org/security/announce/2008/mfsa2008-54.html

Source: cve@mitre.org

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0977.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0978.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/32281

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1021185

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA08-319A.html

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2008/3146

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/0977

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=443299

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11005

Source: cve@mitre.org

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html

Source: cve@mitre.org

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html