CVE-2008-5014

Published: Nov 13, 2008Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.

Affected (9)

Products: Mozilla: Firefox, Seamonkey, Thunderbird · Debian: Debian Linux · Canonical: Ubuntu Linux

3 products

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	From 2.0 to 2.0.0.18
Mozilla Firefox	From 3.0 to 3.0.2
Mozilla Seamonkey	From 1.0 to 1.1.13
Mozilla Thunderbird	From 2.0 to 2.0.0.18

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (76)

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32011

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32684

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32693

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32694

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32695

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32714

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32715

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32721

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32778

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32798

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32845

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32853

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/33433

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/33434

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/34501

Source: secalert@redhat.com

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1

Source: secalert@redhat.com

Broken Link

http://ubuntu.com/usn/usn-667-1

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1669

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1671

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1696

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2009/dsa-1697

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:228

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:230

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:235

Source: secalert@redhat.com

Third Party Advisory

http://www.mozilla.org/security/announce/2008/mfsa2008-50.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0976.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0977.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0978.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/32281

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1021182

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA08-319A.html

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2008/3146

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2009/0977

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=436741

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9157

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html