CVEvulnerability
CVE-2008-4582
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-10-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.
Affected configurations
• debian debian linux 4.0
• mozilla firefox 3.0.1
• mozilla firefox 3.0.2
• mozilla firefox 3.0.3
• mozilla firefox 2.0
• mozilla firefox 2.0.0.1
• mozilla firefox 2.0.0.10
• mozilla firefox 2.0.0.11
• mozilla firefox 2.0.0.12
• mozilla firefox 2.0.0.13
• mozilla firefox 2.0.0.14
• mozilla firefox 2.0.0.15
• mozilla firefox 2.0.0.16
• mozilla firefox 2.0.0.17
• canonical ubuntu linux 6.06
• canonical ubuntu linux 7.10
• canonical ubuntu linux 8.04
• canonical ubuntu linux 8.10
• mozilla seamonkey 1.0
• mozilla seamonkey 1.0.1
• mozilla seamonkey 1.0.2
• mozilla seamonkey 1.0.3
• mozilla seamonkey 1.0.4
• mozilla seamonkey 1.0.5
• mozilla seamonkey 1.0.6
• mozilla seamonkey 1.0.7
• mozilla seamonkey 1.0.8
• mozilla seamonkey 1.0.9
• mozilla seamonkey 1.1
• mozilla seamonkey 1.1.1
• mozilla seamonkey 1.1.2
• mozilla seamonkey 1.1.3
• mozilla seamonkey 1.1.4
• mozilla seamonkey 1.1.5
• mozilla seamonkey 1.1.6
• mozilla seamonkey 1.1.7
• mozilla seamonkey 1.1.8
• mozilla seamonkey 1.1.9
• mozilla seamonkey 1.1.10
• mozilla seamonkey 1.1.11
• mozilla seamonkey 1.1.12
Related
Weakness · not in database (1)
References
- http://liudieyu0.blog124.fc2.com/blog-entry-6.html Broken Link
- http://secunia.com/advisories/32192 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32684 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32693 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32714 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32721 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32778 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32845 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32853 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/33433 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/33434 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/34501 Permissions Required, Third Party Advisory
- http://securityreason.com/securityalert/4416 Third Party Advisory
- http://securitytracker.com/alerts/2008/Nov/1021212.html Third Party Advisory, VDB Entry
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1 Broken Link
- http://ubuntu.com/usn/usn-667-1 Third Party Advisory
- http://www.debian.org/security/2008/dsa-1669 Third Party Advisory
- http://www.debian.org/security/2008/dsa-1671 Third Party Advisory
- http://www.debian.org/security/2009/dsa-1696 Third Party Advisory
- http://www.debian.org/security/2009/dsa-1697 Third Party Advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-47.html Vendor Advisory
- http://www.securityfocus.com/archive/1/497091/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31611 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31747 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1021190 Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA08-319A.html Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2008/2818 Not Applicable
- http://www.vupen.com/english/advisories/2009/0977 Not Applicable
- https://bugzilla.mozilla.org/show_bug.cgi?id=455311 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45740 exchange.xforce.ibmcloud.com
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html Not Applicable
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html Not Applicable
- http://liudieyu0.blog124.fc2.com/blog-entry-6.html Broken Link
- http://secunia.com/advisories/32192 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32684 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32693 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32714 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32721 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32778 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32845 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/32853 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/33433 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/33434 Permissions Required, Third Party Advisory
- http://secunia.com/advisories/34501 Permissions Required, Third Party Advisory
- http://securityreason.com/securityalert/4416 Third Party Advisory
- http://securitytracker.com/alerts/2008/Nov/1021212.html Third Party Advisory, VDB Entry
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1 Broken Link
- http://ubuntu.com/usn/usn-667-1 Third Party Advisory
- http://www.debian.org/security/2008/dsa-1669 Third Party Advisory
- http://www.debian.org/security/2008/dsa-1671 Third Party Advisory
- http://www.debian.org/security/2009/dsa-1696 Third Party Advisory
- http://www.debian.org/security/2009/dsa-1697 Third Party Advisory
- http://www.mozilla.org/security/announce/2008/mfsa2008-47.html Vendor Advisory
- http://www.securityfocus.com/archive/1/497091/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/31611 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/31747 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1021190 Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA08-319A.html Third Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2008/2818 Not Applicable
- http://www.vupen.com/english/advisories/2009/0977 Not Applicable
- https://bugzilla.mozilla.org/show_bug.cgi?id=455311 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45740 exchange.xforce.ibmcloud.com
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html Not Applicable
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html Not Applicable