CVE-2008-5503

Published: Dec 17, 2008Modified: Apr 23, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.

Affected (54)

Products: Mozilla: Firefox, Seamonkey, Thunderbird

3 products

Configuration A

54 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.18
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Seamonkey	Up to 1.1.13
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Thunderbird	Up to 2.0.0.18
Mozilla Thunderbird	Version 2.0.0.0
Mozilla Thunderbird	Version 2.0.0.12
Mozilla Thunderbird	Version 2.0.0.14
Mozilla Thunderbird	Version 2.0.0.16
Mozilla Thunderbird	Version 2.0.0.17
Mozilla Thunderbird	Version 2.0.0.4
Mozilla Thunderbird	Version 2.0.0.5
Mozilla Thunderbird	Version 2.0.0.6
Mozilla Thunderbird	Version 2.0.0.9

References (72)

http://secunia.com/advisories/33184

Source: secalert@redhat.com

http://secunia.com/advisories/33189

Source: secalert@redhat.com

http://secunia.com/advisories/33204

Source: secalert@redhat.com

http://secunia.com/advisories/33205

Source: secalert@redhat.com

http://secunia.com/advisories/33231

Source: secalert@redhat.com

http://secunia.com/advisories/33232

Source: secalert@redhat.com

http://secunia.com/advisories/33408

Source: secalert@redhat.com

http://secunia.com/advisories/33415

Source: secalert@redhat.com

http://secunia.com/advisories/33421

Source: secalert@redhat.com

http://secunia.com/advisories/33433

Source: secalert@redhat.com

http://secunia.com/advisories/33434

Source: secalert@redhat.com

http://secunia.com/advisories/33523

Source: secalert@redhat.com

http://secunia.com/advisories/33547

Source: secalert@redhat.com

http://secunia.com/advisories/34501

Source: secalert@redhat.com

http://secunia.com/advisories/35080

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1696

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1697

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1704

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1707

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:244

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:012

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2008/mfsa2008-61.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2008-1037.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0002.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/32882

Source: secalert@redhat.com

http://www.securitytracker.com/id?1021424

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-690-2

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-701-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-701-2

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0977

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=379959

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/47409

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11423

Source: secalert@redhat.com

https://usn.ubuntu.com/690-3/

Source: secalert@redhat.com

http://secunia.com/advisories/33184