Path Traversal in Linux Kernel

CVE-2008-4067

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.044 (90.4th percentile) — read the EPSS interpretation.

Affected products

Linux Linux_kernel
Mozilla Firefox
Mozilla Seamonkey
Mozilla Thunderbird
Canonical Ubuntu_linux — versions 6.06, 7.04, 7.10
Debian Debian_linux — versions 4.0
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (signature, x_refsource_OVAL, Third Party Advisory, vdb-entry)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_SLACKWARE)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)