Improper input validation in Mozilla Firefox

CVE-2008-5023

Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.033 (87.1th percentile) — read the EPSS interpretation.

Affected products

Mozilla Firefox
Mozilla Seamonkey
Canonical Ubuntu_linux — versions 6.06, 7.10, 8.04
Debian Debian_linux — versions 4.0
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

secalert@redhat.com (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
secalert@redhat.com (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)