CVE-2008-4582: canonical ubuntu_linux

CVSS: 4.3v2.0MediumModified

Published 15-10-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4582 is a medium (CVSS 4.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 10.19% chance of exploitation in the next 30 days, higher than 95.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

29/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

10.19%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 4

DSA-1669-1 DSA-1671-1 DSA-1696-1 DSA-1697-1

Timeline

15-10-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

10.19%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 10.19% on 20-09-2026

20-09-202620-10-2026

EPSS score

10.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaseremotemultipleVerified
Mozilla Firefox 3.0.3 - Internet Shortcut Same Origin Policy Violation
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Mozilla2 products

firefox3.0.1 | 3.0.2 | 3.0.3 | 2.0 | 2.0.0.1 | 2.0.0.10 | 2.0.0.11 | 2.0.0.12 | 2.0.0.13 | 2.0.0.14 | 2.0.0.15 | 2.0.0.16 | 2.0.0.17
seamonkey1.0 | 1.0:alpha | 1.0:beta | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7 | 1.0.8 | 1.0.9 | 1.1 | 1.1:alpha | 1.1:beta | 1.1.1 | 1.1.2 | 1.1.3 | 1.1.4 | 1.1.5 | 1.1.6 | 1.1.7 | 1.1.8 | 1.1.9 | 1.1.10 | 1.1.11 | 1.1.12

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04 | 8.10

Debian1 product

debian_linuxEOL4.0

3 vendors · 4 products

References

32 links

exchange.xforce.ibmcloud.com/vulnerabilities/45740VDB EntryX Refsource XF
www.debian.org/security/2009/dsa-1697Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securitytracker.com/id?1021190VDB EntryX Refsource SECTRACKThird Party Advisory
www.debian.org/security/2008/dsa-1671Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.htmlVendor AdvisoryX Refsource FEDORANot Applicable
www.vupen.com/english/advisories/2009/0977VDB EntryX Refsource VUPENNot Applicable
bugzilla.mozilla.org/show_bug.cgi?id=455311X Refsource MISCIssue Tracking
secunia.com/advisories/32192Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.mozilla.org/security/announce/2008/mfsa2008-47.htmlX Refsource CONFIRMVendor Advisory
securitytracker.com/alerts/2008/Nov/1021212.htmlVDB EntryX Refsource SECTRACKThird Party Advisory

Show all 32 references

www.debian.org/security/2008/dsa-1669Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/32778Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.htmlVendor AdvisoryX Refsource FEDORANot Applicable
secunia.com/advisories/33433Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.vupen.com/english/advisories/2008/2818VDB EntryX Refsource VUPENNot Applicable
www.securityfocus.com/archive/1/497091/100/0/threadedMailing ListX Refsource BUGTRAQ
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Vendor AdvisoryX Refsource SUNALERTBroken Link
securityreason.com/securityalert/4416Third Party AdvisoryX Refsource SREASON
secunia.com/advisories/32721Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.us-cert.gov/cas/techalerts/TA08-319A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/32853Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.debian.org/security/2009/dsa-1696Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/32693Third Party AdvisoryX Refsource SECUNIAPermissions Required
secunia.com/advisories/32845Third Party AdvisoryX Refsource SECUNIAPermissions Required
secunia.com/advisories/33434Third Party AdvisoryX Refsource SECUNIAPermissions Required
secunia.com/advisories/32684Third Party AdvisoryX Refsource SECUNIAPermissions Required
ubuntu.com/usn/usn-667-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/bid/31747VDB EntryX Refsource BIDThird Party Advisory
liudieyu0.blog124.fc2.com/blog-entry-6.htmlX Refsource MISCBroken Link
secunia.com/advisories/32714Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.securityfocus.com/bid/31611VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/34501Third Party AdvisoryX Refsource SECUNIAPermissions Required

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities