{"schemaVersion":3,"id":"CVE-2008-4068","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass \"restrictions imposed on local HTML files,\" and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.","dates":{"published":"2008-09-24T18:00:00.000Z","modified":"2024-08-07T10:00:42.853Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.8,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04166,"percentile":0.90777,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.04166},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04166,"percentile":0.90777}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04166,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04166,"percentile":0.90777}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.06","noFixRecorded":false,"fixedIn":null},{"text":"7.04","noFixRecorded":false,"fixedIn":null},{"text":"7.10","noFixRecorded":false,"fixedIn":null},{"text":"8.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.06 | 7.04 | 7.10 | 8.04","eol":{"isEol":true,"eolDate":"2011-06-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6.06","label":"6.06 'Dapper Drake' (LTS)","eolFrom":"2011-06-01T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"6.06.2"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0","eol":{"isEol":true,"eolDate":"2010-02-15T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"4","label":"4 (Etch)","eolFrom":"2010-02-15T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"4.0r9"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"mozilla","product":"firefox","name":"firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.0.0.17","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0, < 3.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0.17 | ≥ 3.0, < 3.0.2","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.1.12","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.12","eol":null,"hubHref":"/vendor/mozilla/seamonkey"},{"vendor":"mozilla","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.0.0.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.0.17","eol":null,"hubHref":"/vendor/mozilla/thunderbird"}],"affectedCount":5,"eol":{"hasEol":true,"count":2},"references":[{"url":"http://secunia.com/advisories/32025","label":"secunia.com/advisories/32025","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32011","label":"secunia.com/advisories/32011","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232","label":"slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232","hostname":"slackware.com","tags":["Vendor Advisory","X Refsource SLACKWARE","Third Party Advisory"]},{"url":"http://www.debian.org/security/2009/dsa-1697","label":"www.debian.org/security/2009/dsa-1697","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32096","label":"secunia.com/advisories/32096","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html","label":"www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/usn-645-1","label":"www.ubuntu.com/usn/usn-645-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:206","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:206","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32144","label":"secunia.com/advisories/32144","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32010","label":"secunia.com/advisories/32010","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securitytracker.com/id?1020921","label":"www.securitytracker.com/id?1020921","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/0977","label":"www.vupen.com/english/advisories/2009/0977","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/usn-645-2","label":"www.ubuntu.com/usn/usn-645-2","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/31346","label":"www.securityfocus.com/bid/31346","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"http://secunia.com/advisories/31985","label":"secunia.com/advisories/31985","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html","label":"lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"http://secunia.com/advisories/31984","label":"secunia.com/advisories/31984","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32185","label":"secunia.com/advisories/32185","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32196","label":"secunia.com/advisories/32196","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html","label":"www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","Third Party Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1669","label":"www.debian.org/security/2008/dsa-1669","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-44.html","label":"www.mozilla.org/security/announce/2008/mfsa2008-44.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://secunia.com/advisories/32042","label":"secunia.com/advisories/32042","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/33433","label":"secunia.com/advisories/33433","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2008/2661","label":"www.vupen.com/english/advisories/2008/2661","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422","label":"slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422","hostname":"slackware.com","tags":["Vendor Advisory","X Refsource SLACKWARE","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32095","label":"secunia.com/advisories/32095","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32089","label":"secunia.com/advisories/32089","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT","Broken Link"]},{"url":"http://secunia.com/advisories/32092","label":"secunia.com/advisories/32092","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0879.html","label":"www.redhat.com/support/errata/RHSA-2008-0879.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:205","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:205","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Third Party Advisory"]},{"url":"http://www.debian.org/security/2009/dsa-1696","label":"www.debian.org/security/2009/dsa-1696","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://download.novell.com/Download?buildid=WZXONb-tqBw~","label":"download.novell.com/Download?buildid=WZXONb-tqBw~","hostname":"download.novell.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html","label":"www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","Third Party Advisory"]},{"url":"http://secunia.com/advisories/31987","label":"secunia.com/advisories/31987","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45360","label":"exchange.xforce.ibmcloud.com/vulnerabilities/45360","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/usn-647-1","label":"www.ubuntu.com/usn/usn-647-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32007","label":"secunia.com/advisories/32007","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0882.html","label":"www.redhat.com/support/errata/RHSA-2008-0882.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32845","label":"secunia.com/advisories/32845","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.debian.org/security/2008/dsa-1649","label":"www.debian.org/security/2008/dsa-1649","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32012","label":"secunia.com/advisories/32012","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/33434","label":"secunia.com/advisories/33434","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123","label":"slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123","hostname":"slackware.com","tags":["Vendor Advisory","X Refsource SLACKWARE","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32044","label":"secunia.com/advisories/32044","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11471","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11471","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Third Party Advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0908.html","label":"www.redhat.com/support/errata/RHSA-2008-0908.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://secunia.com/advisories/34501","label":"secunia.com/advisories/34501","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32082","label":"secunia.com/advisories/32082","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]}],"lineage":{"upstream":[],"downstream":["DSA-1649-1","DSA-1669-1","DSA-1696-1","DSA-1697-1","RHSA-2008:0879","RHSA-2008:0882","RHSA-2008:0908"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-09-24T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T10:00:42.853Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T20:50:07.900Z","stale":false,"partial":false}}