CVE-2008-0417

Published: Feb 8, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

CRLF injection vulnerability in Mozilla Firefox before 2.0.0.12 allows remote user-assisted web sites to corrupt the user's password store via newlines that are not properly handled when the user saves a password.

Affected (1)

Products: Mozilla: Firefox

Mozilla

1 product

Firefox

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.11

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (82)

http://browser.netscape.com/releasenotes/

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html

Source: secalert@redhat.com

http://secunia.com/advisories/28766

Source: secalert@redhat.com

http://secunia.com/advisories/28818

Source: secalert@redhat.com

http://secunia.com/advisories/28839

Source: secalert@redhat.com

http://secunia.com/advisories/28864

Source: secalert@redhat.com

http://secunia.com/advisories/28865

Source: secalert@redhat.com

http://secunia.com/advisories/28877

Source: secalert@redhat.com

http://secunia.com/advisories/28879

Source: secalert@redhat.com

http://secunia.com/advisories/28924

Source: secalert@redhat.com

http://secunia.com/advisories/28939

Source: secalert@redhat.com

http://secunia.com/advisories/28958

Source: secalert@redhat.com

http://secunia.com/advisories/29086

Source: secalert@redhat.com

http://secunia.com/advisories/29567

Source: secalert@redhat.com

http://secunia.com/advisories/30327

Source: secalert@redhat.com

http://secunia.com/advisories/30620

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1

Source: secalert@redhat.com

http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html

Source: secalert@redhat.com

http://wiki.rpath.com/Advisories:rPSA-2008-0051

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1484

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1485

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1489

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1506

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:048

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2008/mfsa2008-04.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0103.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0104.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/487826/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/488002/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/27683

Source: secalert@redhat.com

http://www.securitytracker.com/id?1019334

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-576-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0453/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0627/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/1793/references

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=394610

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11154

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.html

Source: secalert@redhat.com

http://browser.netscape.com/releasenotes/