CVE-2008-5013

2008-11-1311:30:00

CWE-399

[email protected]

web.nvd.nist.gov

cve-2008-5013

mozilla firefox

seamonkey

remote code execution

swf file

memory address

security vulnerability

nvd

9.5 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.454 Medium

EPSS

Percentile

97.4%

JSON

Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that “dynamically unloads itself from an outside JavaScript function,” which triggers an access of an expired memory address.

CPENameOperatorVersion
mozilla:seamonkeymozilla seamonkeyeq1.1.10
mozilla:firefoxmozilla firefoxeq0.9_rc
mozilla:seamonkeymozilla seamonkeyeq1.0.3
mozilla:firefoxmozilla firefoxeq0.8
mozilla:firefoxmozilla firefoxeq2.0.0.12
mozilla:firefoxmozilla firefoxeq1.5
mozilla:seamonkeymozilla seamonkeyeq1.1.8
mozilla:firefoxmozilla firefoxeq1.5.2
mozilla:seamonkeymozilla seamonkeyeq1.0.1
mozilla:seamonkeymozilla seamonkeyeq1.1.7

CPE	Name	Operator	Version
mozilla:seamonkey	mozilla seamonkey	eq	1.1.10
mozilla:firefox	mozilla firefox	eq	0.9_rc
mozilla:seamonkey	mozilla seamonkey	eq	1.0.3
mozilla:firefox	mozilla firefox	eq	0.8
mozilla:firefox	mozilla firefox	eq	2.0.0.12
mozilla:firefox	mozilla firefox	eq	1.5
mozilla:seamonkey	mozilla seamonkey	eq	1.1.8
mozilla:firefox	mozilla firefox	eq	1.5.2
mozilla:seamonkey	mozilla seamonkey	eq	1.0.1
mozilla:seamonkey	mozilla seamonkey	eq	1.1.7