CVE-2008-5014: canonical ubuntu_linux Improper Input Validation

CVSS: 10.0v2.0HighModified

Published 13-11-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-5014 is a high (CVSS 10.0) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 5.87% chance of exploitation in the next 30 days, higher than 93.1% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

5.87%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 1

DSA-1669-1 DSA-1671-1 DSA-1696-1 DSA-1697-1 OPENSUSE-SU-2024:10601-1 RHSA-2008:0976+2 more

Timeline

13-11-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying the window.__proto__.__proto__ object in a way that causes a lock on a non-native object, which triggers an assertion failure related to the OBJ_IS_NATIVE function.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

5.87%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

0.00 pp

From 5.87% on 20-09-2026

20-09-202620-10-2026

EPSS score

5.87%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Mozilla3 products

firefox≥ 2.0, < 2.0.0.18 | ≥ 3.0, < 3.0.2
seamonkey≥ 1.0, < 1.1.13
thunderbird≥ 2.0, < 2.0.0.18

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04 | 8.10

Debian1 product

debian_linuxEOL4.0

3 vendors · 5 products

References

38 links

secunia.com/advisories/32011Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/3146VDB EntryX Refsource VUPENThird Party Advisory
www.debian.org/security/2009/dsa-1697Vendor AdvisoryX Refsource DEBIANThird Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=436741X Refsource MISCIssue TrackingVendor Advisory
www.debian.org/security/2008/dsa-1671Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/32281VDB EntryX Refsource BIDThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0977.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:230Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.vupen.com/english/advisories/2009/0977VDB EntryX Refsource VUPENThird Party Advisory

Show all 38 references

secunia.com/advisories/32695Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1021182VDB EntryX Refsource SECTRACKThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0978.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.debian.org/security/2008/dsa-1669Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/32778Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0976.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/33433Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/security/announce/2008/mfsa2008-50.htmlX Refsource CONFIRMVendor Advisory
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Vendor AdvisoryX Refsource SUNALERTBroken Link
lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
secunia.com/advisories/32694Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32721Third Party AdvisoryX Refsource SECUNIA
www.us-cert.gov/cas/techalerts/TA08-319A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/32853Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2009/dsa-1696Vendor AdvisoryX Refsource DEBIANThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9157VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/32715Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32693Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:228Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/32845Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:235Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/33434Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32798Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32684Third Party AdvisoryX Refsource SECUNIA
ubuntu.com/usn/usn-667-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/32714Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/34501Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities