CVE-2008-2803: mozilla firefox

CVSS: 6.8v2.0MediumModified

Published 07-07-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-2803 is a medium (CVSS 6.8) vulnerability in mozilla firefox. EPSS estimates a 3.21% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

3.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8

DSA-1607-1 DSA-1615-1 DSA-1621-1 DSA-1697-1 RHSA-2008:0547 RHSA-2008:0549+2 more

Timeline

07-07-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The mozIJSSubScriptLoader.LoadScript function in Mozilla Firefox before 2.0.0.15, Thunderbird 2.0.0.14 and earlier, and SeaMonkey before 1.1.10 does not apply XPCNativeWrappers to scripts loaded from (1) file: URIs, (2) data: URIs, or (3) certain non-canonical chrome: URIs, which allows remote attackers to execute arbitrary code via vectors involving third-party add-ons.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

3.21%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.21% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Mozilla3 products

firefox≤ 2.0.0.14 | 2.0 | 2.0.0.1 | 2.0.0.2 | 2.0.0.3 | 2.0.0.4 | 2.0.0.5 | 2.0.0.6 | 2.0.0.7 | 2.0.0.8 | 2.0.0.9 | 2.0.0.10 | 2.0.0.11 | 2.0.0.12 | 2.0.0.13
seamonkey≤ 1.1.9 | 1.1 | 1.1.2 | 1.1.3 | 1.1.4 | 1.1.5 | 1.1.6 | 1.1.7 | 1.1.8
thunderbird≤ 2.0.0.14 | 2.0.0.0 | 2.0.0.1 | 2.0.0.2 | 2.0.0.3 | 2.0.0.4 | 2.0.0.5 | 2.0.0.6 | 2.0.0.8 | 2.0.0.9 | 2.0.0.11 | 2.0.0.12 | 2.0.0.13

1 vendor · 3 products

References

55 links

lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.htmlVendor AdvisoryX Refsource SUSE
www.redhat.com/support/errata/RHSA-2008-0549.htmlVendor AdvisoryX Refsource REDHAT
www.debian.org/security/2009/dsa-1697Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/31021Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30898Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31403Third Party AdvisoryX Refsource SECUNIA
wiki.rpath.com/Advisories:rPSA-2008-0216X Refsource CONFIRM
issues.rpath.com/browse/RPL-2646X Refsource CONFIRM
secunia.com/advisories/30949Third Party AdvisoryX Refsource SECUNIA
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152Vendor AdvisoryX Refsource SLACKWARE

Show all 55 references

www.vupen.com/english/advisories/2009/0977VDB EntryX Refsource VUPEN
secunia.com/advisories/31069Third Party AdvisoryX Refsource SECUNIA
bugzilla.mozilla.org/show_bug.cgi?id=418356X Refsource CONFIRM
secunia.com/advisories/31008Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31377Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2008-0616.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2008/1993/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/31023Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:155Vendor AdvisoryX Refsource MANDRIVA
www.securityfocus.com/bid/30038VDB EntryX Refsource BID
secunia.com/advisories/30915Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1607Vendor AdvisoryX Refsource DEBIAN
security.gentoo.org/glsa/glsa-200808-03.xmlVendor AdvisoryX Refsource GENTOO
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10747VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/31005Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/33433Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.htmlVendor AdvisoryX Refsource FEDORA
www.securitytracker.com/id?1020419VDB EntryX Refsource SECTRACK
secunia.com/advisories/31253Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/projects/security/known-vulnerabilities.htmlX Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-August/msg00125.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/31183Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30903Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0547.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.htmlVendor AdvisoryX Refsource FEDORA
www.ubuntu.com/usn/usn-629-1Vendor AdvisoryX Refsource UBUNTU
www.mozilla.org/security/announce/2008/mfsa2008-25.htmlX Refsource CONFIRM
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Vendor AdvisoryX Refsource SUNALERT
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911Vendor AdvisoryX Refsource SLACKWARE
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.410484Vendor AdvisoryX Refsource SLACKWARE
www.debian.org/security/2008/dsa-1615Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2008-August/msg00144.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/31220Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31195Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/31076Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-619-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/30911Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2008-0569.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/30878Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1621Vendor AdvisoryX Refsource DEBIAN
www.securityfocus.com/archive/1/494080/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/31286Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/34501Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:136Vendor AdvisoryX Refsource MANDRIVA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities