Skip to content
OpenAdvisories
Unscored CVE-2008-0416 EUVD-2008-0426GHSA-2h42-qmq7-j2qx

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1…

Published Feb 12, 2008 · Updated Aug 7, 2024 · Assigned by redhat

Description

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8 allow remote attackers to inject arbitrary web script or HTML via certain character encodings, including (1) a backspace character that is treated as whitespace, (2) 0x80 with Shift_JIS encoding, and (3) "zero-length non-ASCII sequences" in certain Asian character sets.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 4.0 iceape 1.0.12~pre080131b-0etch1 DSA-1506-1
Debian 4.0 icedove 1.5.0.13+1.5.0.15b.dfsg1-0etch2 DSA-1485-2
Debian 4.0 iceweasel 2.0.0.12-0etch1 DSA-1489-1
Debian 4.0 xulrunner 1.8.0.15~pre080131b-0etch1 DSA-1484-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 5 firefox 1.5.0.12-9.el5 RHSA-2008:0103
RHEL 4 firefox 1.5.0.12-0.10.el4 RHSA-2008:0103
RHEL 4 seamonkey +5 1.0.9-9.el4 RHSA-2008:0104
RHEL 3 seamonkey +9 1.0.9-0.9.el3 RHSA-2008:0104
RHEL 2 seamonkey +9 1.0.9-0.9.el2 RHSA-2008:0104

Advisories 6

References