CVE-2008-0418

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Mozilla Firefox 2.0 - 'chrome://' URI JavaScript File Request Information Disclosure2008-01-19 · remote · linux · Verified

Impact

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://browser.netscape.com/releasenotes/
• http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html
• http://secunia.com/advisories/28622/
• http://secunia.com/advisories/28754
• http://secunia.com/advisories/28766
• http://secunia.com/advisories/28808
• http://secunia.com/advisories/28815
• http://secunia.com/advisories/28818
• http://secunia.com/advisories/28839
• http://secunia.com/advisories/28864
• http://secunia.com/advisories/28865
• http://secunia.com/advisories/28877
• http://secunia.com/advisories/28879
• http://secunia.com/advisories/28924
• http://secunia.com/advisories/28939
• http://secunia.com/advisories/28958
• http://secunia.com/advisories/29049
• http://secunia.com/advisories/29086
• http://secunia.com/advisories/29098
• http://secunia.com/advisories/29164
• http://secunia.com/advisories/29167
• http://secunia.com/advisories/29211
• http://secunia.com/advisories/29567
• http://secunia.com/advisories/30327
• http://secunia.com/advisories/30620