Description
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080323b-0etch1 | DSA-1534-2, DSA-1534-1 |
| Debian 4.0 | iceweasel | 2.0.0.13-0etch1 | DSA-1535-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080323b-0etch1 | DSA-1532-1 |
Advisories 4
- DSA-1534-1 iceape Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1532-1 xulrunner Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1534-2 iceape - regression Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1535-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20080327 rPSA-2008-0128-1 firefox mailing-list
- 29541 third-party-advisory
- 29539 third-party-advisory
- 30620 third-party-advisory
- 29560 third-party-advisory
- DSA-1532 vendor-advisory
- 30327 third-party-advisory
- 238492 vendor-advisory
- USN-592-1 vendor-advisory
- 29616 third-party-advisory
- 29645 third-party-advisory
- ADV-2008-1793 vdb-entry
- mozilla-liveconnect-unauthorized-access(41458) vdb-entry
- 29558 third-party-advisory
- 29526 third-party-advisory
- SUSE-SA:2008:019 vendor-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-18.html
- TA08-087A third-party-advisory
- 28448 vdb-entry
- DSA-1534 vendor-advisory
- 29547 third-party-advisory
- GLSA-200805-18 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
- ADV-2008-0998 vdb-entry
- DSA-1535 vendor-advisory
- MDVSA-2008:080 vendor-advisory