CVE-2008-0417: mozilla firefox Code Injection

CVSS: 4.3v2.0MediumModified

Published 08-02-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-0417 is a medium (CVSS 4.3) Code Injection vulnerability in mozilla firefox. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities.

Overall risk

17/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

1.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 2

DSA-1484-1 DSA-1485-2 DSA-1489-1 DSA-1506-1 OPENSUSE-SU-2024:10600-1 OPENSUSE-SU-2024:14572-1+2 more

Timeline

08-02-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

CRLF injection vulnerability in Mozilla Firefox before 2.0.0.12 allows remote user-assisted web sites to corrupt the user's password store via newlines that are not properly handled when the user saves a password.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

1.44%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

0.00 pp

From 1.44% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Mozilla1 product

firefox≤ 2.0.0.11

1 vendor · 1 product

References

41 links

www.redhat.com/support/errata/RHSA-2008-0104.htmlVendor AdvisoryX Refsource REDHAT
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11154VDB EntrySignatureX Refsource OVAL
www.ubuntu.com/usn/usn-576-1Vendor AdvisoryX Refsource UBUNTU
browser.netscape.com/releasenotes/X Refsource CONFIRM
secunia.com/advisories/28939Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1506Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/28766Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28818Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30620Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28865Third Party AdvisoryX Refsource SECUNIA

Show all 41 references

www.vupen.com/english/advisories/2008/0453/referencesVDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2008-0103.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/28877Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28879Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29567Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28958Third Party AdvisoryX Refsource SECUNIA
support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.htmlX Refsource CONFIRM
secunia.com/advisories/30327Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1Vendor AdvisoryX Refsource SUNALERT
www.debian.org/security/2008/dsa-1489Vendor AdvisoryX Refsource DEBIAN
www.securityfocus.com/archive/1/488002/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/487826/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29086Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1019334VDB EntryX Refsource SECTRACK
secunia.com/advisories/28864Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1485Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/28924Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/27683VDB EntryX Refsource BID
www.mozilla.org/security/announce/2008/mfsa2008-04.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2008/1793/referencesVDB EntryX Refsource VUPEN
lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.htmlVendor AdvisoryX Refsource SUSE
bugzilla.mozilla.org/show_bug.cgi?id=394610X Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-February/msg00309.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/archives/fedora-package-announce/2008-February/msg00381.htmlVendor AdvisoryX Refsource FEDORA
wiki.rpath.com/Advisories:rPSA-2008-0051X Refsource CONFIRM
www.debian.org/security/2008/dsa-1484Vendor AdvisoryX Refsource DEBIAN
www.vupen.com/english/advisories/2008/0627/referencesVDB EntryX Refsource VUPEN
www.gentoo.org/security/en/glsa/glsa-200805-18.xmlVendor AdvisoryX Refsource GENTOO
www.redhat.com/archives/fedora-package-announce/2008-February/msg00274.htmlVendor AdvisoryX Refsource FEDORA
www.mandriva.com/security/advisories?name=MDVSA-2008:048Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/28839Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities