CVE-2008-5021: canonical ubuntu_linux Race Condition

CVSS: 9.3v2.0HighModified

Published 13-11-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-5021 is a high (CVSS 9.3) Race Condition vulnerability in canonical ubuntu_linux. EPSS estimates a 3.63% chance of exploitation in the next 30 days, higher than 89.4% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

3.63%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 1

DSA-1669-1 DSA-1671-1 DSA-1696-1 DSA-1697-1 OPENSUSE-SU-2024:10601-1 RHSA-2008:0976+2 more

Timeline

13-11-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

3.63%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

0.00 pp

From 3.63% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Suse4 products

linux_enterprise_debuginfo10:sp2
linux_enterprise_desktop10
linux_enterprise_server9 | 10:sp1
linux_enterprise_software_development_kit10:sp1 | 10:sp2

Mozilla3 products

firefox≥ 2.0, < 2.0.0.18 | ≥ 3.0, < 3.0.4
seamonkey≥ 1.0, < 1.1.13
thunderbird≥ 2.0, < 2.0.0.18

Novell2 products

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04 | 8.10

Debian1 product

debian_linuxEOL4.0

Fedoraproject1 product

fedoraEOL8 | 9

Opensuse1 product

opensuseEOL10.2 | 10.3 | 11.0

7 vendors · 13 products

References

38 links

www.vupen.com/english/advisories/2008/3146VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
www.debian.org/security/2009/dsa-1697Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
www.debian.org/security/2008/dsa-1671Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
www.securityfocus.com/bid/32281VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
secunia.com/advisories/32713Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/support/errata/RHSA-2008-0977.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:230Vendor AdvisoryX Refsource MANDRIVABroken LinkThird Party Advisory
www.vupen.com/english/advisories/2009/0977VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
secunia.com/advisories/32695Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 38 references

www.redhat.com/support/errata/RHSA-2008-0978.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
www.debian.org/security/2008/dsa-1669Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
secunia.com/advisories/32778Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/support/errata/RHSA-2008-0976.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
secunia.com/advisories/33433Third Party AdvisoryX Refsource SECUNIABroken Link
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Vendor AdvisoryX Refsource SUNALERTBroken Link
www.mozilla.org/security/announce/2008/mfsa2008-55.htmlX Refsource CONFIRMVendor Advisory
lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/32694Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/32721Third Party AdvisoryX Refsource SECUNIABroken Link
www.us-cert.gov/cas/techalerts/TA08-319A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
bugzilla.mozilla.org/show_bug.cgi?id=460002X Refsource MISCIssue TrackingVendor Advisory
secunia.com/advisories/32853Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2009/dsa-1696Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
www.securitytracker.com/id?1021186VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/32715Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/32693Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2008:228Vendor AdvisoryX Refsource MANDRIVABroken LinkThird Party Advisory
secunia.com/advisories/32845Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2008:235Vendor AdvisoryX Refsource MANDRIVABroken LinkThird Party Advisory
secunia.com/advisories/33434Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/32798Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/32684Third Party AdvisoryX Refsource SECUNIABroken Link
ubuntu.com/usn/usn-667-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9642VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
secunia.com/advisories/32714Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34501Third Party AdvisoryX Refsource SECUNIABroken Link

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities