CVE-2008-0418

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 8.6%

from disclosure to weapon0 days

Published on NVDFeb 8

1st PoCJan 19

exploitation probability

8.6%top 5% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/31051

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://browser.netscape.com/releasenotes/http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html http://secunia.com/advisories/28622/http://secunia.com/advisories/28754 http://secunia.com/advisories/28766 http://secunia.com/advisories/28808 http://secunia.com/advisories/28815 http://secunia.com/advisories/28818 http://secunia.com/advisories/28839 http://secunia.com/advisories/28864 http://secunia.com/advisories/28865 http://secunia.com/advisories/28877