Description
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.12~pre080131b-0etch1 | DSA-1506-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1-0etch2 | DSA-1485-2 |
| Debian 4.0 | iceweasel | 2.0.0.12-0etch1 | DSA-1489-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080131b-0etch1 | DSA-1484-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 1.5.0.12-9.el5 | RHSA-2008:0103 |
| RHEL 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
| RHEL 4 | firefox | 1.5.0.12-0.10.el4 | RHSA-2008:0103 |
| RHEL 4 | seamonkey +5 | 1.0.9-9.el4 | RHSA-2008:0104 |
| RHEL 4 | thunderbird | 1.5.0.12-8.el4 | RHSA-2008:0105 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.9.el3 | RHSA-2008:0104 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.9.el2 | RHSA-2008:0104 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 1.5.0.12-8.el5 | RHSA-2008:0105 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 92.0-1.2 | openSUSE-SU-2024:10600-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Mozilla Firefox 2.0 - 'chrome://' URI JavaScript File Request Information Disclosure EDB-31051 · remote · Jan 19, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- RHSA-2008:0104 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0105 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0103 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1489-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1506-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1484-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1485-2 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10600-1 MozillaFirefox-92.0-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2008:0104 vendor-advisory
- USN-582-2 vendor-advisory
- 1019329 vdb-entry
- USN-576-1 vendor-advisory
- http://browser.netscape.com/releasenotes/
- 28939 third-party-advisory
- DSA-1506 vendor-advisory
- VU#309608 third-party-advisory
- SSA:2008-061-01 vendor-advisory
- https://issues.rpath.com/browse/RPL-1995
- FEDORA-2008-2118 vendor-advisory
- FEDORA-2008-2060 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
- 28766 third-party-advisory
- 28622 third-party-advisory
- 28818 third-party-advisory
- 30620 third-party-advisory
- 28865 third-party-advisory
- 29049 third-party-advisory
- ADV-2008-0453 vdb-entry
- RHSA-2008:0103 vendor-advisory
- 28877 third-party-advisory
- 28879 third-party-advisory
- USN-582-1 vendor-advisory
- 29167 third-party-advisory
- 29567 third-party-advisory
- RHSA-2008:0105 vendor-advisory
- 28958 third-party-advisory
- http://support.novell.com/techcenter/psdb/6251b18e050302ebe7fe74294b55c818.html
- 30327 third-party-advisory
- 238492 vendor-advisory
- 20080229 rPSA-2008-0093-1 thunderbird mailing-list
- DSA-1489 vendor-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-05.html
- 20080212 FLEA-2008-0001-1 firefox mailing-list
- 20080209 rPSA-2008-0051-1 firefox mailing-list
- 29086 third-party-advisory
- 28815 third-party-advisory
- ADV-2008-0454 vdb-entry
- 239546 vendor-advisory
- 28864 third-party-advisory
- DSA-1485 vendor-advisory
- 28924 third-party-advisory
- ADV-2008-1793 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2008-0093
- ADV-2008-2091 vdb-entry
- SUSE-SA:2008:008 vendor-advisory
- FEDORA-2008-1459 vendor-advisory
- 29164 third-party-advisory
- 29211 third-party-advisory
- FEDORA-2008-1535 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0051
- MDVSA-2008:062 vendor-advisory
- DSA-1484 vendor-advisory
- 28808 third-party-advisory
- ADV-2008-0263 vdb-entry
- oval:org.mitre.oval:def:10705 vdb-entry signature
- ADV-2008-0627 vdb-entry
- GLSA-200805-18 vendor-advisory
- 28754 third-party-advisory