CVE-2008-5015: Code Injection
Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5015?
CVE-2008-5015 is rated as a moderate severity vulnerability.
How do I fix CVE-2008-5015?
To fix CVE-2008-5015, upgrade Mozilla Firefox to version 3.0.4 or later.
What versions of Mozilla Firefox are affected by CVE-2008-5015?
CVE-2008-5015 affects Mozilla Firefox versions 3.0 through 3.0.3, as well as pre-released versions like 3.0-alpha, 3.0-beta2, and 3.0-beta5.
What impact does CVE-2008-5015 have on users?
CVE-2008-5015 allows user-assisted attackers to execute arbitrary JavaScript with chrome privileges through malicious file URIs.
Is there a known exploit for CVE-2008-5015?
While there may not be widespread exploitation reported, CVE-2008-5015 creates a security risk that can be leveraged by attackers.