NetSight
IP …
medium5.0

CVE-2008-5012

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a c…

Impact

Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.

Affected products

VendorProductAffected versions
MozillaFirefox
through 2.0.0.17
Versions 0.8, 0.9, 0.9.1, 0.9.2, 0.9.3
MozillaSeamonkey
through 1.1.12
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4
MozillaThunderbird
through 2.0.0.17
Versions 0.1, 0.2, 0.3, 0.4, 0.5

Weakness classification

CWE-200

References