CVE-2008-4067

Published: Sep 24, 2008Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.

Affected (9)

Products: Mozilla: Firefox, Seamonkey, Thunderbird · Debian: Debian Linux · Canonical: Ubuntu Linux

3 products

1 product

1 product

Configuration A

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 2.0.0.17
Mozilla Firefox	From 3.0 to 3.0.2
Mozilla Seamonkey	Before 1.1.12
Mozilla Thunderbird	Before 2.0.0.17

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (106)

http://download.novell.com/Download?buildid=WZXONb-tqBw~

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31984

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31985

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31987

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32007

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32010

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32011

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32012

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32025

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32042

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32044

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32082

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32089

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32092

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32095

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32096

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32144

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32185

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32196

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32845

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/33433

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/33434

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/34501

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123

Source: secalert@redhat.com

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1

Source: secalert@redhat.com

Broken Link

http://www.0x000000.com/?i=422

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1649

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1669

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1696

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1697

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:205

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:206

Source: secalert@redhat.com

Third Party Advisory

http://www.mozilla.org/security/announce/2008/mfsa2008-44.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0879.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0882.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0908.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/31346

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020921

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-645-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/usn-645-2

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/usn-647-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2008/2661

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/0977

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=380994

Source: secalert@redhat.com

ExploitIssue TrackingVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=394075

Source: secalert@redhat.com

ExploitIssue TrackingVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/45359

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10770

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html

Source: secalert@redhat.com

Third Party Advisory

http://download.novell.com/Download?buildid=WZXONb-tqBw~