CVE-2008-0418

Published: Feb 8, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.

Affected (3)

Products: Mozilla: Firefox, Seamonkey, Thunderbird

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.11
Mozilla Seamonkey	Up to 1.1.7
Mozilla Thunderbird	Up to 2.0.0.11

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (134)

http://browser.netscape.com/releasenotes/

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html

Source: secalert@redhat.com

http://secunia.com/advisories/28622/

Source: secalert@redhat.com

http://secunia.com/advisories/28754

Source: secalert@redhat.com

http://secunia.com/advisories/28766

Source: secalert@redhat.com

http://secunia.com/advisories/28808

Source: secalert@redhat.com

http://secunia.com/advisories/28815

Source: secalert@redhat.com

http://secunia.com/advisories/28818

Source: secalert@redhat.com

http://secunia.com/advisories/28839

Source: secalert@redhat.com

http://secunia.com/advisories/28864

Source: secalert@redhat.com

http://secunia.com/advisories/28865

Source: secalert@redhat.com

http://secunia.com/advisories/28877

Source: secalert@redhat.com

http://secunia.com/advisories/28879

Source: secalert@redhat.com

http://secunia.com/advisories/28924

Source: secalert@redhat.com

http://secunia.com/advisories/28939

Source: secalert@redhat.com

http://secunia.com/advisories/28958

Source: secalert@redhat.com

http://secunia.com/advisories/29049

Source: secalert@redhat.com

http://secunia.com/advisories/29086

Source: secalert@redhat.com

http://secunia.com/advisories/29098

Source: secalert@redhat.com

http://secunia.com/advisories/29164

Source: secalert@redhat.com

http://secunia.com/advisories/29167

Source: secalert@redhat.com

http://secunia.com/advisories/29211

Source: secalert@redhat.com

http://secunia.com/advisories/29567

Source: secalert@redhat.com

http://secunia.com/advisories/30327

Source: secalert@redhat.com

http://secunia.com/advisories/30620

Source: secalert@redhat.com

http://secunia.com/advisories/31043

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.445399

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1

Source: secalert@redhat.com

http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html

Source: secalert@redhat.com

http://wiki.rpath.com/Advisories:rPSA-2008-0051

Source: secalert@redhat.com

http://wiki.rpath.com/Advisories:rPSA-2008-0093

Source: secalert@redhat.com

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1484

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1485

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1489

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1506

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml

Source: secalert@redhat.com

http://www.hiredhacker.com/2008/01/19/firefox-chrome-url-handling-directory-traversal/

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/309608

Source: secalert@redhat.com

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2008:048

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:062

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2008/mfsa2008-05.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0103.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0104.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0105.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/487826/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/488002/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/488971/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/27406

Source: secalert@redhat.com

http://www.securitytracker.com/id?1019329

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-576-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-582-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-582-2

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0263

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0453/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0454/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0627/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/1793/references

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/2091/references

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1995

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10705

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00905.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00946.html

Source: secalert@redhat.com

http://browser.netscape.com/releasenotes/