CVE-2008-0593

Published: Feb 9, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Gecko-based browsers, including Mozilla Firefox before 2.0.0.12 and SeaMonkey before 1.1.8, modify the .href property of stylesheet DOM nodes to the final URI of a 302 redirect, which might allow remote attackers to bypass the Same Origin Policy and read sensitive information from the original URL, such as with Single-Signon systems.

Affected (38)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

10 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.11
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0

Configuration B

28 vulnerable

Vulnerable Software	Affected Versions
Mozilla Seamonkey	All versions
Mozilla Seamonkey	Up to 1.1.17
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.99
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.14
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.16
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (96)

http://browser.netscape.com/releasenotes/

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html

Source: secalert@redhat.com

http://secunia.com/advisories/28754

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28758

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28766

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28815

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28818

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28839

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28864

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28865

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28877

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28879

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28924

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28939

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28958

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29049

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29086

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29167

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29567

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/30327

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/30620

Source: secalert@redhat.com

Vendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1

Source: secalert@redhat.com

http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html

Source: secalert@redhat.com

http://wiki.rpath.com/Advisories:rPSA-2008-0051

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1484

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1485

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1489

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1506

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:048

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2008/mfsa2008-10.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0103.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0104.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0105.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/archive/1/487826/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/27683

Source: secalert@redhat.com

http://www.securitytracker.com/id?1019341

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-576-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0453/references

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2008/0627/references

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2008/1793/references

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=397427

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10075

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00905.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00946.html

Source: secalert@redhat.com

http://browser.netscape.com/releasenotes/