XPath Injection in Mozilla Firefox
CVE-2008-5024
Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.
EPSS: 0.036 (88.4th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox
- Mozilla Seamonkey
- Mozilla Thunderbird
- Canonical Ubuntu_linux — versions 6.06, 7.10, 8.04
- Debian Debian_linux — versions 4.0
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- secalert@redhat.com (Exploit, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Third Party Advisory)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (Third Party Advisory, vdb-entry, x_refsource_VUPEN)