CVEvulnerability

CVE-2008-5021

9.3 HIGH Published 2008-11-13 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-11-13
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-362

Description

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.

Affected configurations

• mozilla firefox (>= 2.0 < 2.0.0.18) • mozilla firefox (>= 3.0 < 3.0.4) • mozilla seamonkey (>= 1.0 < 1.1.13) • mozilla thunderbird (>= 2.0 < 2.0.0.18) • debian debian linux 4.0 • canonical ubuntu linux 6.06 • canonical ubuntu linux 7.10 • canonical ubuntu linux 8.04 • canonical ubuntu linux 8.10 • fedoraproject fedora 8 • fedoraproject fedora 9 • suse linux enterprise debuginfo 10 • novell linux desktop 9 • novell open enterprise server • opensuse opensuse 10.2 • opensuse opensuse 10.3 • opensuse opensuse 11.0 • suse linux enterprise desktop 10 • suse linux enterprise server 9 • suse linux enterprise server 10 • suse linux enterprise software development kit 10

Related

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

Referenced by CWE · observed example (3)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-665 Improper Initialization weakness
  • CWE-908 Use of Uninitialized Resource weakness

References