CVE-2008-5508: Input Validation
First published: Wed Dec 17 2008(Updated: )
Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | >=2.0<2.0.0.19 | |
| Mozilla Firefox | >=3.0<3.0.5 | |
| Mozilla SeaMonkey | >=1.0<1.1.14 | |
| Mozilla Thunderbird | >=2.0<2.0.0.19 | |
| Canonical Ubuntu Linux | =6.06 | |
| Canonical Ubuntu Linux | =7.10 | |
| Canonical Ubuntu Linux | =8.04 | |
| Canonical Ubuntu Linux | =8.10 | |
| Debian Debian Linux | =4.0 | |
| Debian Debian Linux | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=425046
- https://bugzilla.mozilla.org/show_bug.cgi?id=460803
- http://www.mozilla.org/security/announce/2008/mfsa2008-66.html
- http://secunia.com/advisories/33231
- http://www.debian.org/security/2009/dsa-1697
- http://secunia.com/advisories/33433
- http://secunia.com/advisories/33523
- http://secunia.com/advisories/33204
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:012
- http://www.securitytracker.com/id?1021426
- http://secunia.com/advisories/33203
- http://secunia.com/advisories/33205
- http://www.redhat.com/support/errata/RHSA-2008-1036.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:245
- http://secunia.com/advisories/33184
- http://www.redhat.com/support/errata/RHSA-2008-1037.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:244
- http://www.securityfocus.com/bid/32882
- http://secunia.com/advisories/33216
- http://www.ubuntu.com/usn/usn-690-2
- http://secunia.com/advisories/33188
- http://secunia.com/advisories/33547
- http://secunia.com/advisories/33189
- http://www.debian.org/security/2009/dsa-1707
- http://www.debian.org/security/2009/dsa-1704
- http://secunia.com/advisories/33421
- http://secunia.com/advisories/33434
- http://www.redhat.com/support/errata/RHSA-2009-0002.html
- http://www.debian.org/security/2009/dsa-1696
- http://secunia.com/advisories/34501
- http://www.vupen.com/english/advisories/2009/0977
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1
- http://secunia.com/advisories/35080
- http://www.ubuntu.com/usn/usn-701-2
- http://www.ubuntu.com/usn/usn-701-1
- http://secunia.com/advisories/33408
- http://secunia.com/advisories/33415
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47414
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11040
- https://usn.ubuntu.com/690-1/
- agent/severity
- agent/weakness
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/references
- agent/author
- vendor/mozilla
- canonical/mozilla firefox
- version/mozilla firefox/2.0
- version/mozilla firefox/3.0
- canonical/mozilla seamonkey
- version/mozilla seamonkey/1.0
- canonical/mozilla thunderbird
- version/mozilla thunderbird/2.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/6.06
- version/canonical ubuntu linux/7.10
- version/canonical ubuntu linux/8.04
- version/canonical ubuntu linux/8.10
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/5.0
- version/debian debian linux/4.0