CVE-2008-4066

Published: Sep 24, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav&#56325ascript" sequence, aka "HTML escaped low surrogates bug."

Affected (3)

Products: Mozilla: Firefox

Mozilla

1 product

Firefox

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (88)

http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx

Source: secalert@redhat.com

Exploit

http://download.novell.com/Download?buildid=WZXONb-tqBw~

Source: secalert@redhat.com

http://jvn.jp/en/jp/JVN96950482/index.html

Source: secalert@redhat.com

http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000058.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html

Source: secalert@redhat.com

http://secunia.com/advisories/31984

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/31985

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32007

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32010

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32012

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32025

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32042

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32044

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32082

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32092

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32144

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32185

Source: secalert@redhat.com

http://secunia.com/advisories/32196

Source: secalert@redhat.com

http://secunia.com/advisories/32845

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34501

Source: secalert@redhat.com

Vendor Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1649

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1669

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:205

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:206

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2008/mfsa2008-43.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0882.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0908.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/31346

Source: secalert@redhat.com

http://www.securitytracker.com/id?1020920

Source: secalert@redhat.com

http://www.thespanner.co.uk/2008/06/30/javascript-protocol-fuzz-results/

Source: secalert@redhat.com

Exploit

http://www.ubuntu.com/usn/usn-645-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-645-2

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-647-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/2661

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/0977

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=448166

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/45358

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8880

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html

Source: secalert@redhat.com

Vendor Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html

Source: secalert@redhat.com

http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx