Vulnerabilidad en Mozilla Firefox y SeaMonkey (CVE-2008-2810)
Gravedad CVSS v2.0:
MEDIA
Tipo:
CWE-264
Permisos, privilegios y/o control de acceso
Fecha de publicación:
07/07/2008
Última modificación:
11/10/2018
Descripción
Mozilla Firefox anterior a 2.0.0.15 y SeaMonkey anterior a 1.1.10, no identifican correctamente el contexto de los ficheros de acceso de directo de Windows, esto permite a atacantes remotos con la ayuda del usuario evitar el Same Origin Policy mediante un sitio Web manipulado en el que el usuario haya guardado previamente un acceso directo.
Impacto
Puntuación base 2.0
6.80
Gravedad 2.0
MEDIA
Productos y versiones vulnerables
CPE | Desde | Hasta |
---|---|---|
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* | 2.0.0.14 (incluyendo) | |
cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:* | ||
cpe:2.3:a:mozilla:firefox:2.0.0.13:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2008-0616.html
- http://secunia.com/advisories/30878
- http://secunia.com/advisories/30898
- http://secunia.com/advisories/30903
- http://secunia.com/advisories/30911
- http://secunia.com/advisories/30949
- http://secunia.com/advisories/31005
- http://secunia.com/advisories/31008
- http://secunia.com/advisories/31021
- http://secunia.com/advisories/31023
- http://secunia.com/advisories/31076
- http://secunia.com/advisories/31195
- http://secunia.com/advisories/31377
- http://secunia.com/advisories/33433
- http://security.gentoo.org/glsa/glsa-200808-03.xml
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911
- http://wiki.rpath.com/Advisories:rPSA-2008-0216
- http://www.debian.org/security/2009/dsa-1697
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15
- http://www.mozilla.org/security/announce/2008/mfsa2008-32.html
- http://www.redhat.com/support/errata/RHSA-2008-0547.html
- http://www.redhat.com/support/errata/RHSA-2008-0549.html
- http://www.redhat.com/support/errata/RHSA-2008-0569.html
- http://www.securityfocus.com/archive/1/494080/100/0/threaded
- http://www.securityfocus.com/bid/30038
- http://www.securitytracker.com/id?1020419=
- http://www.ubuntu.com/usn/usn-619-1
- http://www.vupen.com/english/advisories/2008/1993/references
- https://bugzilla.mozilla.org/show_bug.cgi?id=410156
- https://issues.rpath.com/browse/RPL-2646
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9593
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.html
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.html
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.html