cvelistv5 - cve-2008-0594

CVE-2008-0594 (GCVE-0-2008-0594)

Vulnerability from cvelistv5

Published

2008-02-09 00:00

Modified

2024-08-07 07:54

Severity ?

CWE

Summary

Mozilla Firefox before 2.0.0.12 does not always display a web forgery warning dialog if the entire contents of a web page are in a DIV tag that uses absolute positioning, which makes it easier for remote attackers to conduct phishing attacks.

References

URL

Tags

	http://www.ubuntu.com/usn/usn-576-1	vendor-advisory, x_refsource_UBUNTU
	http://browser.netscape.com/releasenotes/	x_refsource_CONFIRM
	http://secunia.com/advisories/28939	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2008/dsa-1506	vendor-advisory, x_refsource_DEBIAN
	http://secunia.com/advisories/30620	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/28865	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/0453/references	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/28877	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/28879	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/29567	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/28958	third-party-advisory, x_refsource_SECUNIA
	http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html	x_refsource_CONFIRM
	http://secunia.com/advisories/30327	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1	vendor-advisory, x_refsource_SUNALERT
	http://www.debian.org/security/2008/dsa-1489	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/archive/1/488002/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.securityfocus.com/archive/1/487826/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/29086	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/28864	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2008/dsa-1485	vendor-advisory, x_refsource_DEBIAN
	http://secunia.com/advisories/28924	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/27683	vdb-entry, x_refsource_BID
	http://www.vupen.com/english/advisories/2008/1793/references	vdb-entry, x_refsource_VUPEN
	http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html	vendor-advisory, x_refsource_SUSE
	http://www.securitytracker.com/id?1019342	vdb-entry, x_refsource_SECTRACK
	http://www.mozilla.org/security/announce/2008/mfsa2008-11.html	x_refsource_CONFIRM
	https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.html	vendor-advisory, x_refsource_FEDORA
	http://wiki.rpath.com/Advisories:rPSA-2008-0051	x_refsource_CONFIRM
	http://www.debian.org/security/2008/dsa-1484	vendor-advisory, x_refsource_DEBIAN
	http://www.vupen.com/english/advisories/2008/0627/references	vdb-entry, x_refsource_VUPEN
	https://bugzilla.mozilla.org/show_bug.cgi?id=408164	x_refsource_CONFIRM
	http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml	vendor-advisory, x_refsource_GENTOO
	https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.html	vendor-advisory, x_refsource_FEDORA
	http://www.mandriva.com/security/advisories?name=MDVSA-2008:048	vendor-advisory, x_refsource_MANDRIVA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:54:22.847Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-576-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-576-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://browser.netscape.com/releasenotes/"
          },
          {
            "name": "28939",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28939"
          },
          {
            "name": "DSA-1506",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1506"
          },
          {
            "name": "30620",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30620"
          },
          {
            "name": "28865",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28865"
          },
          {
            "name": "ADV-2008-0453",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0453/references"
          },
          {
            "name": "28877",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28877"
          },
          {
            "name": "28879",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28879"
          },
          {
            "name": "29567",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29567"
          },
          {
            "name": "28958",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28958"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html"
          },
          {
            "name": "30327",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30327"
          },
          {
            "name": "238492",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1"
          },
          {
            "name": "DSA-1489",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1489"
          },
          {
            "name": "20080212 FLEA-2008-0001-1 firefox",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/488002/100/0/threaded"
          },
          {
            "name": "20080209 rPSA-2008-0051-1 firefox",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/487826/100/0/threaded"
          },
          {
            "name": "29086",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29086"
          },
          {
            "name": "28864",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28864"
          },
          {
            "name": "DSA-1485",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1485"
          },
          {
            "name": "28924",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28924"
          },
          {
            "name": "27683",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/27683"
          },
          {
            "name": "ADV-2008-1793",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1793/references"
          },
          {
            "name": "SUSE-SA:2008:008",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html"
          },
          {
            "name": "1019342",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1019342"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2008/mfsa2008-11.html"
          },
          {
            "name": "FEDORA-2008-1535",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0051"
          },
          {
            "name": "DSA-1484",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1484"
          },
          {
            "name": "ADV-2008-0627",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0627/references"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=408164"
          },
          {
            "name": "GLSA-200805-18",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml"
          },
          {
            "name": "FEDORA-2008-1435",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.html"
          },
          {
            "name": "MDVSA-2008:048",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:048"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-02-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla Firefox before 2.0.0.12 does not always display a web forgery warning dialog if the entire contents of a web page are in a DIV tag that uses absolute positioning, which makes it easier for remote attackers to conduct phishing attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-576-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-576-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://browser.netscape.com/releasenotes/"
        },
        {
          "name": "28939",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28939"
        },
        {
          "name": "DSA-1506",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1506"
        },
        {
          "name": "30620",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30620"
        },
        {
          "name": "28865",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28865"
        },
        {
          "name": "ADV-2008-0453",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0453/references"
        },
        {
          "name": "28877",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28877"
        },
        {
          "name": "28879",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28879"
        },
        {
          "name": "29567",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29567"
        },
        {
          "name": "28958",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28958"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html"
        },
        {
          "name": "30327",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30327"
        },
        {
          "name": "238492",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1"
        },
        {
          "name": "DSA-1489",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1489"
        },
        {
          "name": "20080212 FLEA-2008-0001-1 firefox",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/488002/100/0/threaded"
        },
        {
          "name": "20080209 rPSA-2008-0051-1 firefox",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/487826/100/0/threaded"
        },
        {
          "name": "29086",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29086"
        },
        {
          "name": "28864",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28864"
        },
        {
          "name": "DSA-1485",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1485"
        },
        {
          "name": "28924",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28924"
        },
        {
          "name": "27683",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/27683"
        },
        {
          "name": "ADV-2008-1793",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1793/references"
        },
        {
          "name": "SUSE-SA:2008:008",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html"
        },
        {
          "name": "1019342",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1019342"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2008/mfsa2008-11.html"
        },
        {
          "name": "FEDORA-2008-1535",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0051"
        },
        {
          "name": "DSA-1484",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1484"
        },
        {
          "name": "ADV-2008-0627",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0627/references"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=408164"
        },
        {
          "name": "GLSA-200805-18",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml"
        },
        {
          "name": "FEDORA-2008-1435",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.html"
        },
        {
          "name": "MDVSA-2008:048",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:048"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2008-0594",
    "datePublished": "2008-02-09T00:00:00.000Z",
    "dateReserved": "2008-02-05T00:00:00.000Z",
    "dateUpdated": "2024-08-07T07:54:22.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2008-AVI-062

Vulnerability from certfr_avis

Plusieurs vulnérabilités ont été identifiées dans le navigateur Mozilla Firefox. L'exploitation de ces dernières peut conduire notamment à l'exécution de code arbitraire à distance.

Description

Plusieurs vulnérabilités ont été identifiées dans le navigateur Mozilla Firefox. Parmi celles-ci :

des vulnérabilités concernent le moteur JavaScript et provoquent sous certaines conditions une corruption de mémoire.
le navigateur ne manipulerait pas correctement les contrôles d'entrée de fichiers associés à des balises de type label, pouvant provoquer le vol de fichiers arbitraires sur le poste de la victime ;
des vulnérabilités permettent de contourner la politique de source commune (same-origin policy) et permettre d'injecter du code dans un autre site. L'une d'elle est rendue possible par la fonction XMLDocument.load() ;
la gestion du stockage des mots de passe ne serait pas correcte : à l'ajout d'une entrée, le site distant pourrait altérer les mots de passe déjà présents et concernant d'autres sites ;
l'URI chrome: permettrait de transgresser les droits d'accès et donc d'accéder à des fichiers (scripts ou images par exemple), lorsque certains modules complémentaires sont installés (CERTA-2008-ACT-004) ;
les images ne sont pas correctement manipulées à la fermeture d'une page qui utilise des cadres designMode. Cette vulnérabilité permettrait ainsi de dérober des historiques de navigation ou perturber le navigateur.

Solution

Se référer aux bulletins de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Mozilla Firefox pour les versions antérieures à 2.0.0.12 ;
Mozilla SeaMonkey pour les versions antérieures 1.1.8 ;
Mozilla Thunderbird pour les versions antérieures à 2.0.0.12.

A la date de rédaction de cet avis, la version 2.0.0.12 de Thunderbird n'est cependant pas téléchargeable sur le site officiel Mozilla.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Annonce de la mise à jour Mozilla Firefox 2.0.0.12 du 07 février 2008	None	vendor-advisory
Bulletin de sécurité RedHat RHSA-2008-0104 du 08 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-04 du 07 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-08 du 07 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-05 du 07 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-09 du 07 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-11 du 07 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-03 du 07 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-06 du 07 février 2008 :	-	other
Bulletin de sécurité RedHat RHSA-2008-0103 du 08 février 2008 :	-	other
Bulletin de sécurité Debian DSA-1484 du 10 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-10 du 07 février 2008 :	-	other
Bulletin de sécurité Ubuntu USN-576-1 du 08 février 2008 :	-	other
Bulletin de sécurité Debian DSA-1485 du 10 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-02 du 07 février 2008 :	-	other
Bulletin de sécurité de la fondation Mozilla 2008/MFSA2008-01 du 07 février 2008 :	-	other
Bulletin de sécurité RedHat RHSA-2008-0105 du 08 février 2008 :	-	other
Bulletin de sécurité Debian DSA-1489 du 10 février 2008 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cUL\u003e    \u003cLI\u003eMozilla Firefox pour les versions ant\u00e9rieures \u00e0 2.0.0.12    ;\u003c/LI\u003e    \u003cLI\u003eMozilla SeaMonkey pour les versions ant\u00e9rieures 1.1.8    ;\u003c/LI\u003e    \u003cLI\u003eMozilla Thunderbird pour les versions ant\u00e9rieures \u00e0    2.0.0.12.\u003c/LI\u003e  \u003c/UL\u003e  \u003cP\u003eA la date de r\u00e9daction de cet avis, la version 2.0.0.12 de  Thunderbird n\u0027est cependant pas t\u00e9l\u00e9chargeable sur le site  officiel Mozilla.\u003c/P\u003e",
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le navigateur Mozilla\nFirefox. Parmi celles-ci :\n\n-   des vuln\u00e9rabilit\u00e9s concernent le moteur JavaScript et provoquent\n    sous certaines conditions une corruption de m\u00e9moire.\n-   le navigateur ne manipulerait pas correctement les contr\u00f4les\n    d\u0027entr\u00e9e de fichiers associ\u00e9s \u00e0 des balises de type label, pouvant\n    provoquer le vol de fichiers arbitraires sur le poste de la victime\n    ;\n-   des vuln\u00e9rabilit\u00e9s permettent de contourner la politique de source\n    commune (same-origin policy) et permettre d\u0027injecter du code dans un\n    autre site. L\u0027une d\u0027elle est rendue possible par la fonction\n    XMLDocument.load() ;\n-   la gestion du stockage des mots de passe ne serait pas correcte : \u00e0\n    l\u0027ajout d\u0027une entr\u00e9e, le site distant pourrait alt\u00e9rer les mots de\n    passe d\u00e9j\u00e0 pr\u00e9sents et concernant d\u0027autres sites ;\n-   l\u0027URI chrome: permettrait de transgresser les droits d\u0027acc\u00e8s et donc\n    d\u0027acc\u00e9der \u00e0 des fichiers (scripts ou images par exemple), lorsque\n    certains modules compl\u00e9mentaires sont install\u00e9s (CERTA-2008-ACT-004)\n    ;\n-   les images ne sont pas correctement manipul\u00e9es \u00e0 la fermeture d\u0027une\n    page qui utilise des cadres designMode. Cette vuln\u00e9rabilit\u00e9\n    permettrait ainsi de d\u00e9rober des historiques de navigation ou\n    perturber le navigateur.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2008-0415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0415"
    },
    {
      "name": "CVE-2008-0417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0417"
    },
    {
      "name": "CVE-2008-0418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0418"
    },
    {
      "name": "CVE-2008-0419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0419"
    },
    {
      "name": "CVE-2008-0413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0413"
    },
    {
      "name": "CVE-2008-0592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0592"
    },
    {
      "name": "CVE-2008-0593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0593"
    },
    {
      "name": "CVE-2008-0414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0414"
    },
    {
      "name": "CVE-2008-0591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0591"
    },
    {
      "name": "CVE-2008-0594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0594"
    },
    {
      "name": "CVE-2008-0412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2008-0412"
    }
  ],
  "initial_release_date": "2008-02-08T00:00:00",
  "last_revision_date": "2008-02-11T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2008-0104 du 08 f\u00e9vrier    2008 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2008-0104.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-04 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-04.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-08 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-08.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-05 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-05.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-09 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-09.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-11 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-11.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-03 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-03.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-06 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-06.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2008-0103 du 08 f\u00e9vrier    2008 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2008-0103.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1484 du 10 f\u00e9vrier 2008 :",
      "url": "http://www.debian.org/security/2008/dsa-1484"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-10 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-10.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-576-1 du 08 f\u00e9vrier 2008 :",
      "url": "http://www.ubuntu.com/usn/usn-576-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1485 du 10 f\u00e9vrier 2008 :",
      "url": "http://www.debian.org/security/2008/dsa-1485"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-02 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-02.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de la fondation Mozilla    2008/MFSA2008-01 du 07 f\u00e9vrier 2008 :",
      "url": "http://www.mozilla.org/security/announce/2008/MFSA2008-01.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2008-0105 du 08 f\u00e9vrier    2008 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2008-0105.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-1489 du 10 f\u00e9vrier 2008 :",
      "url": "http://www.debian.org/security/2008/dsa-1489"
    }
  ],
  "reference": "CERTA-2008-AVI-062",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-02-08T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Debian.",
      "revision_date": "2008-02-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le navigateur Mozilla\nFirefox. L\u0027exploitation de ces derni\u00e8res peut conduire notamment \u00e0\nl\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Annonce de la mise \u00e0 jour Mozilla Firefox 2.0.0.12 du 07 f\u00e9vrier 2008",
      "url": null
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2008-0594 (GCVE-0-2008-0594)

Vulnerability from cvelistv5

CERTA-2008-AVI-062

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature