CVE-2008-1233: mozilla firefox Code Injection

CVSS: 6.8v2.0MediumModified

Published 27-03-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1233 is a medium (CVSS 6.8) Code Injection vulnerability in mozilla firefox. EPSS estimates a 4.34% chance of exploitation in the next 30 days, higher than 91.1% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

4.34%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 1

DSA-1532-1 DSA-1534-1 DSA-1534-2 DSA-1535-1 DSA-1574-1 OPENSUSE-SU-2024:10601-1+3 more

Timeline

27-03-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via "XPCNativeWrapper pollution."

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

4.34%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.34% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Mozilla3 products

firefox≤ 2.0.0.12
seamonkey≤ 1.1.8
thunderbird≤ 2.0.0.12

1 vendor · 3 products

References

51 links

www.securityfocus.com/archive/1/490196/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29541Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29539Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/security/announce/2008/mfsa2008-14.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2008/0999/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/30620Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29560Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/41443VDB EntryX Refsource XF
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11078VDB EntrySignatureX Refsource OVAL
www.debian.org/security/2008/dsa-1532Vendor AdvisoryX Refsource DEBIAN

Show all 51 references

secunia.com/advisories/30327Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1Vendor AdvisoryX Refsource SUNALERT
www.ubuntu.com/usn/usn-592-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29616Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1019694VDB EntryX Refsource SECTRACK
secunia.com/advisories/29550Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29645Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-605-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/29607Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1Vendor AdvisoryX Refsource SUNALERT
www.mandriva.com/security/advisories?name=MDVSA-2008:155Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2008/1793/referencesVDB EntryX Refsource VUPEN
www.debian.org/security/2008/dsa-1574Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/29558Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29548Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30370Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2008-0208.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/29526Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2091/referencesVDB EntryX Refsource VUPEN
lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.htmlVendor AdvisoryX Refsource SUSE
www.us-cert.gov/cas/techalerts/TA08-087A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/29391Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/30192Third Party AdvisoryX Refsource SECUNIA
www.kb.cert.org/vuls/id/466521Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.447313Vendor AdvisoryX Refsource SLACKWARE
www.redhat.com/support/errata/RHSA-2008-0209.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/bid/28448VDB EntryX Refsource BID
www.redhat.com/support/errata/RHSA-2008-0207.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/30016Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1534Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2008-May/msg00058.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/29547Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30105Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30094Third Party AdvisoryX Refsource SECUNIA
www.gentoo.org/security/en/glsa/glsa-200805-18.xmlVendor AdvisoryX Refsource GENTOO
wiki.rpath.com/wiki/Advisories:rPSA-2008-0128X Refsource CONFIRM
secunia.com/advisories/31043Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-May/msg00074.htmlVendor AdvisoryX Refsource FEDORA
www.vupen.com/english/advisories/2008/0998/referencesVDB EntryX Refsource VUPEN
www.debian.org/security/2008/dsa-1535Vendor AdvisoryX Refsource DEBIAN
www.mandriva.com/security/advisories?name=MDVSA-2008:080Vendor AdvisoryX Refsource MANDRIVA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities