{"schemaVersion":3,"id":"CVE-2008-5024","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.","dates":{"published":"2008-11-13T11:00:00.000Z","modified":"2024-08-07T10:40:17.153Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03641,"percentile":0.89442,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.03641},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03641,"percentile":0.89442}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03641,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03641,"percentile":0.89442}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_5D9FDAFBB0E614FB","name":"Exploit Reference (bugzilla.mozilla.org)","source":"reference","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=453915","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-91","name":"XML Injection (aka Blind XPath Injection)","description":"The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/91.html"}],"affected":[{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.06","noFixRecorded":false,"fixedIn":null},{"text":"7.10","noFixRecorded":false,"fixedIn":null},{"text":"8.04","noFixRecorded":false,"fixedIn":null},{"text":"8.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.06 | 7.10 | 8.04 | 8.10","eol":{"isEol":true,"eolDate":"2011-06-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6.06","label":"6.06 'Dapper Drake' (LTS)","eolFrom":"2011-06-01T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"6.06.2"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0","eol":{"isEol":true,"eolDate":"2010-02-15T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"4","label":"4 (Etch)","eolFrom":"2010-02-15T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"4.0r9"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0, < 2.0.0.18","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0, < 3.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0, < 2.0.0.18 | ≥ 3.0, < 3.0.4","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.0, < 1.1.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.0, < 1.1.13","eol":null,"hubHref":"/vendor/mozilla/seamonkey"},{"vendor":"mozilla","product":"thunderbird","name":"Thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0, < 2.0.0.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0, < 2.0.0.18","eol":null,"hubHref":"/vendor/mozilla/thunderbird"}],"affectedCount":5,"eol":{"hasEol":true,"count":2},"references":[{"url":"http://www.vupen.com/english/advisories/2008/3146","label":"www.vupen.com/english/advisories/2008/3146","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://www.debian.org/security/2009/dsa-1697","label":"www.debian.org/security/2009/dsa-1697","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=453915","label":"bugzilla.mozilla.org/show_bug.cgi?id=453915","hostname":"bugzilla.mozilla.org","tags":["X Refsource MISC","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1671","label":"www.debian.org/security/2008/dsa-1671","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/32281","label":"www.securityfocus.com/bid/32281","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html","label":"www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32713","label":"secunia.com/advisories/32713","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0977.html","label":"www.redhat.com/support/errata/RHSA-2008-0977.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:230","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:230","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/0977","label":"www.vupen.com/english/advisories/2009/0977","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32695","label":"secunia.com/advisories/32695","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0978.html","label":"www.redhat.com/support/errata/RHSA-2008-0978.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"http://www.debian.org/security/2008/dsa-1669","label":"www.debian.org/security/2008/dsa-1669","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32778","label":"secunia.com/advisories/32778","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0976.html","label":"www.redhat.com/support/errata/RHSA-2008-0976.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html","label":"www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA","Third Party Advisory"]},{"url":"http://secunia.com/advisories/33433","label":"secunia.com/advisories/33433","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html","label":"lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32694","label":"secunia.com/advisories/32694","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32721","label":"secunia.com/advisories/32721","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-319A.html","label":"www.us-cert.gov/cas/techalerts/TA08-319A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://secunia.com/advisories/32853","label":"secunia.com/advisories/32853","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.debian.org/security/2009/dsa-1696","label":"www.debian.org/security/2009/dsa-1696","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id?1021192","label":"www.securitytracker.com/id?1021192","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9063","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9063","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32715","label":"secunia.com/advisories/32715","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32693","label":"secunia.com/advisories/32693","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-58.html","label":"www.mozilla.org/security/announce/2008/mfsa2008-58.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:228","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:228","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32845","label":"secunia.com/advisories/32845","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:235","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:235","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA","Third Party Advisory"]},{"url":"http://secunia.com/advisories/33434","label":"secunia.com/advisories/33434","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32798","label":"secunia.com/advisories/32798","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/32684","label":"secunia.com/advisories/32684","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://ubuntu.com/usn/usn-667-1","label":"ubuntu.com/usn/usn-667-1","hostname":"ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://secunia.com/advisories/32714","label":"secunia.com/advisories/32714","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/34501","label":"secunia.com/advisories/34501","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]}],"lineage":{"upstream":[],"downstream":["DSA-1669-1","DSA-1671-1","DSA-1696-1","DSA-1697-1","OPENSUSE-SU-2024:10601-1","RHSA-2008:0976","RHSA-2008:0977","RHSA-2008:0978"],"duplicates":[],"related":["OPENSUSE-SU-2024:10601-1"]},"timeline":[{"kind":"published","date":"2008-11-13T11:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T10:40:17.153Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":41,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:18:30.342Z","stale":false,"partial":false}}