CVE-2008-5012

Published: Nov 13, 2008Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.

Affected (144)

Products: Mozilla: Firefox, Seamonkey, Thunderbird

3 products

Configuration A

144 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.17
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 0.9_rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Seamonkey	Up to 1.1.12
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.99
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.5 1.1.10
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 beta
Mozilla Thunderbird	Up to 2.0.0.17
Mozilla Thunderbird	Version 0.1
Mozilla Thunderbird	Version 0.2
Mozilla Thunderbird	Version 0.3
Mozilla Thunderbird	Version 0.4
Mozilla Thunderbird	Version 0.5
Mozilla Thunderbird	Version 0.6
Mozilla Thunderbird	Version 0.7.1
Mozilla Thunderbird	Version 0.7.2
Mozilla Thunderbird	Version 0.7.3
Mozilla Thunderbird	Version 0.7
Mozilla Thunderbird	Version 0.8
Mozilla Thunderbird	Version 0.9
Mozilla Thunderbird	Version 1.0.1
Mozilla Thunderbird	Version 1.0.2
Mozilla Thunderbird	Version 1.0.3
Mozilla Thunderbird	Version 1.0.4
Mozilla Thunderbird	Version 1.0.5
Mozilla Thunderbird	Version 1.0.5 beta
Mozilla Thunderbird	Version 1.0.6
Mozilla Thunderbird	Version 1.0.7
Mozilla Thunderbird	Version 1.0.8
Mozilla Thunderbird	Version 1.0
Mozilla Thunderbird	Version 1.5.0.10
Mozilla Thunderbird	Version 1.5.0.11
Mozilla Thunderbird	Version 1.5.0.1
Mozilla Thunderbird	Version 1.5.0.2
Mozilla Thunderbird	Version 1.5.0.3
Mozilla Thunderbird	Version 1.5.0.4
Mozilla Thunderbird	Version 1.5.0.6
Mozilla Thunderbird	Version 1.5.0.7
Mozilla Thunderbird	Version 1.5.0.8
Mozilla Thunderbird	Version 1.5.0.9
Mozilla Thunderbird	Version 1.5.1
Mozilla Thunderbird	Version 1.5.2
Mozilla Thunderbird	Version 1.5
Mozilla Thunderbird	Version 1.5 beta2
Mozilla Thunderbird	Version 1.7.1
Mozilla Thunderbird	Version 1.7.3
Mozilla Thunderbird	Version 2.0.0.0
Mozilla Thunderbird	Version 2.0.0.11
Mozilla Thunderbird	Version 2.0.0.12
Mozilla Thunderbird	Version 2.0.0.13
Mozilla Thunderbird	Version 2.0.0.14
Mozilla Thunderbird	Version 2.0.0.15
Mozilla Thunderbird	Version 2.0.0.16
Mozilla Thunderbird	Version 2.0.0.1
Mozilla Thunderbird	Version 2.0.0.2
Mozilla Thunderbird	Version 2.0.0.3
Mozilla Thunderbird	Version 2.0.0.4

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (74)

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html

Source: secalert@redhat.com

http://scary.beasts.org/security/CESA-2008-009.html

Source: secalert@redhat.com

http://scarybeastsecurity.blogspot.com/2008/11/firefox-cross-domain-image-theft-and.html

Source: secalert@redhat.com

http://secunia.com/advisories/32684

Source: secalert@redhat.com

http://secunia.com/advisories/32693

Source: secalert@redhat.com

http://secunia.com/advisories/32694

Source: secalert@redhat.com

http://secunia.com/advisories/32714

Source: secalert@redhat.com

http://secunia.com/advisories/32715

Source: secalert@redhat.com

http://secunia.com/advisories/32778

Source: secalert@redhat.com

http://secunia.com/advisories/32798

Source: secalert@redhat.com

http://secunia.com/advisories/32845

Source: secalert@redhat.com

http://secunia.com/advisories/32853

Source: secalert@redhat.com

http://secunia.com/advisories/33433

Source: secalert@redhat.com

http://secunia.com/advisories/33434

Source: secalert@redhat.com

http://secunia.com/advisories/34501

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1

Source: secalert@redhat.com

http://ubuntu.com/usn/usn-667-1

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1669

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1671

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1696

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1697

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:228

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:235

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2008/mfsa2008-48.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0976.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-0977.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/498468

Source: secalert@redhat.com

http://www.securityfocus.com/bid/32281

Source: secalert@redhat.com

http://www.securityfocus.com/bid/32351

Source: secalert@redhat.com

http://www.securitytracker.com/id?1021187

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA08-319A.html

Source: secalert@redhat.com

US Government Resource

http://www.vupen.com/english/advisories/2008/3146

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0977

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=355126

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=451619

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10750

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html