CVE-2008-4067
24.09.2008, 20:37
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | 𝑥 < 2.0.0.17 |
| mozilla | firefox | 3.0 ≤ 𝑥 < 3.0.2 |
| mozilla | seamonkey | 𝑥 < 1.1.12 |
| mozilla | thunderbird | 𝑥 < 2.0.0.17 |
| debian | debian_linux | 4.0 |
| canonical | ubuntu_linux | 6.06 |
| canonical | ubuntu_linux | 7.04 |
| canonical | ubuntu_linux | 7.10 |
| canonical | ubuntu_linux | 8.04 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| firefox |
| ||||||||||||||||||||
| firefox-3.0 |
| ||||||||||||||||||||
| iceape |
| ||||||||||||||||||||
| mozilla-thunderbird |
| ||||||||||||||||||||
| seamonkey |
| ||||||||||||||||||||
| thunderbird |
| ||||||||||||||||||||
| xulrunner |
| ||||||||||||||||||||
| xulrunner-1.9 |
|
References