Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-4066

Overview

Vulnerability Score 4.3 4.3
CVE Id CVE-2008-4066
Last Modified 29 Oct 2012 11:16:31
Published 24 Sep 2008 04:37:04
Confidentiality Impact NONE NONE
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2008-4066

Summary

Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav�ascript" sequence, aka "HTML escaped low surrogates bug."

Vulnerable Systems

Application

  • Mozilla Firefox 2.0.0.14

  • Mozilla Firefox 2.0.0.15

  • Mozilla Firefox 2.0.0.16


References

FEDORA - FEDORA-2008-8429

FEDORA - FEDORA-2008-8401

CONFIRM - https://bugzilla.mozilla.org/show_bug.cgi?id=448166

XF - firefox-htmlparser-security-bypass(45358)

VUPEN - ADV-2009-0977

VUPEN - ADV-2008-2661

UBUNTU - USN-647-1

UBUNTU - USN-645-2

UBUNTU - USN-645-1

MISC - http://www.thespanner.co.uk/2008/06/30/javascript-protocol-fuzz-results/

SECTRACK - 1020920

BID - 31346

REDHAT - RHSA-2008:0908

REDHAT - RHSA-2008:0882

CONFIRM - http://www.mozilla.org/security/announce/2008/mfsa2008-43.html

MANDRIVA - MDVSA-2008:206

MANDRIVA - MDVSA-2008:205

DEBIAN - DSA-1669

SUNALERT - 256408

SLACKWARE - SSA:2008-270-01

SLACKWARE - SSA:2008-269-01

SLACKWARE - SSA:2008-269-02

SECUNIA - 34501

SECUNIA - 32845

SECUNIA - 32144

SECUNIA - 32092

SECUNIA - 32082

SECUNIA - 32044

SECUNIA - 32042

SECUNIA - 32025

SECUNIA - 32012

SECUNIA - 32010

SECUNIA - 32007

SECUNIA - 31985

SECUNIA - 31984

SUSE - SUSE-SA:2008:050

JVNDB - JVNDB-2011-000058

JVN - JVN#96950482

CONFIRM - http://download.novell.com/Download?buildid=WZXONb-tqBw~

MISC - http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx

DEBIAN - DSA-1649

SECUNIA - 32196

SECUNIA - 32185

Related Patches

Novell SUSE 2008:5654 gecko-sdk security update for SLE 10 i586


Last Updated: 27 May 2016 11:01:18