CVE-2008-4059: mozilla firefox

CVSS: 7.5v2.0HighModified

AliasesCGA-v9q2-v89p-qjx6CGA-xh2r-x4x3-28jf

Published 24-09-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4059 is a high (CVSS 7.5) vulnerability in mozilla firefox. EPSS estimates a 5.00% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

5.00%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 2

DSA-1649-1 DSA-1669-1 DSA-1696-1 DSA-1697-1 RHSA-2008:0882 RHSA-2008:0908+2 more

Timeline

24-09-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

5.00%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 5.00% on 19-09-2026

19-09-202619-10-2026

EPSS score

5.00%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Chainguard1 product

firefox< 136.0.3-r0

Mozilla1 product

firefox≤ 2.0.0.17 | 0.8 | 0.9 | 0.9:rc | 0.9.1 | 0.9.2 | 0.9.3 | 0.9_rc | 0.10 | 0.10.1 | 1.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7 | 1.0.8 | 1.5 | 1.5:beta1 | 1.5:beta2 | 1.5.0.1 | 1.5.0.2 | 1.5.0.3 | 1.5.0.4 | 1.5.0.5 | 1.5.0.6 | 1.5.0.7 | 1.5.0.8 | 1.5.0.9 | 1.5.0.10 | 1.5.0.11 | 1.5.0.12 | 1.5.1 | 1.5.2 | 1.5.3 | 1.5.4 | 1.5.5 | 1.5.6 | 1.5.7 | 1.5.8 | 1.8 | 2.0 | 2.0:beta1 | 2.0:rc2 | 2.0:rc3 | 2.0.0.1 | 2.0.0.2 | 2.0.0.3 | 2.0.0.4 | 2.0.0.5 | 2.0.0.6 | 2.0.0.7 | 2.0.0.8 | 2.0.0.9 | 2.0.0.10 | 2.0.0.11 | 2.0.0.12 | 2.0.0.13 | 2.0.0.14 | 2.0.0.15 | 2.0.0.16

Wolfi1 product

firefox< 136.0.3-r0

3 vendors · 3 products

References

44 links

secunia.com/advisories/32025Third Party AdvisoryX Refsource SECUNIA
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232Vendor AdvisoryX Refsource SLACKWARE
www.debian.org/security/2009/dsa-1697Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.htmlVendor AdvisoryX Refsource FEDORA
www.ubuntu.com/usn/usn-645-1Vendor AdvisoryX Refsource UBUNTU
www.mandriva.com/security/advisories?name=MDVSA-2008:206Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/32144Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32010Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/security/announce/2008/mfsa2008-41.htmlX Refsource CONFIRM
www.vupen.com/english/advisories/2009/0977VDB EntryX Refsource VUPEN

Show all 44 references

www.ubuntu.com/usn/usn-645-2Vendor AdvisoryX Refsource UBUNTU
www.securityfocus.com/bid/31346VDB EntryX Refsource BID
secunia.com/advisories/31985Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/31984Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32185Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32196Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/45352VDB EntryX Refsource XF
www.debian.org/security/2008/dsa-1669Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/32042Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/33433Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2661VDB EntryX Refsource VUPEN
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422Vendor AdvisoryX Refsource SLACKWARE
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/32092Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:205Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2009/dsa-1696Vendor AdvisoryX Refsource DEBIAN
bugzilla.mozilla.org/show_bug.cgi?id=419848X Refsource CONFIRMPatch
download.novell.com/Download?buildid=WZXONb-tqBw~X Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.htmlVendor AdvisoryX Refsource FEDORA
www.securitytracker.com/id?1020915VDB EntryX Refsource SECTRACK
www.ubuntu.com/usn/usn-647-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/32007Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0882.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/32845Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1649Vendor AdvisoryX Refsource DEBIAN
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9529VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/32012Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/33434Third Party AdvisoryX Refsource SECUNIA
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123Vendor AdvisoryX Refsource SLACKWARE
secunia.com/advisories/32044Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0908.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/34501Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32082Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities