Description
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080614i-0etch1 | DSA-1697-1 |
| Debian 4.0 | icedove | 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1 | DSA-1696-1 |
| Debian 4.0 | iceweasel | 2.0.0.17-0etch1 | DSA-1649-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080614h-0etch1 | DSA-1669-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | devhelp +1 | 0.12-19.el5 | RHSA-2008:0879 |
| RHEL 5 | firefox | 3.0.2-3.el5 | RHSA-2008:0879 |
| RHEL 5 | nss +3 | 3.12.1.1-1.el5 | RHSA-2008:0879 |
| RHEL 5 | thunderbird | 2.0.0.17-1.el5 | RHSA-2008:0908 |
| RHEL 5 | xulrunner +2 | 1.9.0.2-5.el5 | RHSA-2008:0879 |
| RHEL 5 | yelp | 2.16.0-21.el5 | RHSA-2008:0879 |
| RHEL 4 | devhelp +1 | 0.10-0.10.el4 | RHSA-2008:0882 |
| RHEL 4 | firefox | 3.0.2-3.el4 | RHSA-2008:0879 |
| RHEL 4 | seamonkey +5 | 1.0.9-26.el4 | RHSA-2008:0882 |
| RHEL 4 | thunderbird | 1.5.0.12-16.el4 | RHSA-2008:0908 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.24.el3 | RHSA-2008:0882 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.20.el2 | RHSA-2008:0882 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 2.0.0.17-1.el5 | RHSA-2008:0908 |
Advisories 7
- RHSA-2008:0879 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0908 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0882 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1697-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1649-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1669-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1696-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 32025 third-party-advisory
- 32011 third-party-advisory
- SSA:2008-269-01 vendor-advisory
- DSA-1697 vendor-advisory
- 32096 third-party-advisory
- FEDORA-2008-8401 vendor-advisory
- USN-645-1 vendor-advisory
- MDVSA-2008:206 vendor-advisory
- 32144 third-party-advisory
- 32010 third-party-advisory
- 1020921 vdb-entry
- ADV-2009-0977 vdb-entry
- USN-645-2 vendor-advisory
- 31346 vdb-entry
- 31985 third-party-advisory
- SUSE-SA:2008:050 vendor-advisory
- 31984 third-party-advisory
- 32185 third-party-advisory
- 32196 third-party-advisory
- FEDORA-2008-8425 vendor-advisory
- DSA-1669 vendor-advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-44.html
- 32042 third-party-advisory
- 33433 third-party-advisory
- ADV-2008-2661 vdb-entry
- SSA:2008-269-02 vendor-advisory
- 32095 third-party-advisory
- 32089 third-party-advisory
- 256408 vendor-advisory
- 32092 third-party-advisory
- RHSA-2008:0879 vendor-advisory
- MDVSA-2008:205 vendor-advisory
- DSA-1696 vendor-advisory
- http://download.novell.com/Download?buildid=WZXONb-tqBw~
- FEDORA-2008-8429 vendor-advisory
- 31987 third-party-advisory
- mozilla-resourceprotocol-info-disclosure(45360) vdb-entry
- USN-647-1 vendor-advisory
- 32007 third-party-advisory
- RHSA-2008:0882 vendor-advisory
- 32845 third-party-advisory
- DSA-1649 vendor-advisory
- 32012 third-party-advisory
- 33434 third-party-advisory
- SSA:2008-270-01 vendor-advisory
- 32044 third-party-advisory
- oval:org.mitre.oval:def:11471 vdb-entry signature
- RHSA-2008:0908 vendor-advisory
- 34501 third-party-advisory
- 32082 third-party-advisory