Vulnerability Details : CVE-2008-1234

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka "Universal XSS using event handlers."
Publish Date : 2008-03-27 Last Update Date : 2017-09-28

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	4.3
Confidentiality Impact	None (There is no impact to the confidentiality of the system.)
Integrity Impact	Partial (Modification of some system files or information is possible, but the attacker does not have control over what can be modified, or the scope of what the attacker can affect is limited.)
Availability Impact	None (There is no impact to the availability of the system.)
Access Complexity	Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Cross Site Scripting
CWE ID	79

- Additional Vendor Supplied Data

Vendor	Impact	CVSS Score	CVSS Vector	Report Date	Publish Date
Redhat	moderate			2008-03-12	2008-03-26

If you are a vendor and you have additional data which can be automatically imported into our database, please contact admin @ cvedetails.com

- Related OVAL Definitions

Title	Definition Id	Family
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey ...	oval:org.mitre.oval:def:9551	unix
CVE-2008-1234	oval:org.opensuse.security:def:20081234	unix
DSA-1532 xulrunner -- several vulnerabilities	oval:org.mitre.oval:def:7955	unix
DSA-1532-1 xulrunner	oval:org.mitre.oval:def:18755	unix
DSA-1534 iceape -- several vulnerabilities	oval:org.mitre.oval:def:7869	unix
DSA-1534-1 iceape	oval:org.mitre.oval:def:18729	unix
DSA-1534-2 iceape - regression	oval:org.mitre.oval:def:19906	unix
DSA-1535 iceweasel -- several vulnerabilities	oval:org.mitre.oval:def:7395	unix
DSA-1535-1 iceweasel	oval:org.mitre.oval:def:20297	unix
DSA-1574 icedove -- several vulnerabilities	oval:org.mitre.oval:def:7681	unix
DSA-1574-1 icedove - several vulnerabilities	oval:org.mitre.oval:def:18655	unix
ELSA-2008:0207: firefox security update (Critical)	oval:org.mitre.oval:def:22714	unix
ELSA-2008:0209: thunderbird security update (Moderate)	oval:org.mitre.oval:def:22699	unix
RHSA-2008:0207: firefox security update (Critical)	oval:com.redhat.rhsa:def:20080207	unix
RHSA-2008:0208: seamonkey security update (Critical)	oval:com.redhat.rhsa:def:20080208	unix
RHSA-2008:0209: thunderbird security update (Moderate)	oval:com.redhat.rhsa:def:20080209	unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2008-1234

#	Product Type	Vendor	Product	Version
1	Application	Mozilla	Firefox	2.0.0.12	Version Details Vulnerabilities
2	Application	Mozilla	Seamonkey	1.1.8	Version Details Vulnerabilities
3	Application	Mozilla	Thunderbird	2.0.0.12	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Mozilla	Firefox	1
Mozilla	Seamonkey	1
Mozilla	Thunderbird	1

- References For CVE-2008-1234

https://exchange.xforce.ibmcloud.com/vulnerabilities/41455
XF firefox-eventhandlers-xss(41455)

https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00058.html
FEDORA FEDORA-2008-3519

http://www.vupen.com/english/advisories/2008/2091/references
VUPEN ADV-2008-2091

http://www.vupen.com/english/advisories/2008/1793/references
VUPEN ADV-2008-1793

http://www.vupen.com/english/advisories/2008/0998/references
VUPEN ADV-2008-0998

http://www.vupen.com/english/advisories/2008/0999/references
VUPEN ADV-2008-0999

http://www.us-cert.gov/cas/techalerts/TA08-087A.html
CERT TA08-087A

http://www.ubuntu.com/usn/usn-605-1
UBUNTU USN-605-1

http://www.ubuntu.com/usn/usn-592-1
UBUNTU USN-592-1

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.447313
SLACKWARE SSA:2008-128-02

http://www.securityfocus.com/bid/28448
BID 28448 Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12 Multiple Remote Vulnerabilities Release Date:2014-09-23

http://www.securitytracker.com/id?1019694
SECTRACK 1019694

http://www.securityfocus.com/archive/1/archive/1/490196/100/0/threaded
BUGTRAQ 20080327 rPSA-2008-0128-1 firefox

http://www.redhat.com/support/errata/RHSA-2008-0209.html
REDHAT RHSA-2008:0209

http://www.redhat.com/support/errata/RHSA-2008-0207.html
REDHAT RHSA-2008:0207

http://www.mozilla.org/security/announce/2008/mfsa2008-14.html CONFIRM

http://www.mandriva.com/security/advisories?name=MDVSA-2008:155
MANDRIVA MDVSA-2008:155

http://www.mandriva.com/security/advisories?name=MDVSA-2008:080
MANDRIVA MDVSA-2008:080

http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml
GENTOO GLSA-200805-18

http://www.kb.cert.org/vuls/id/466521
CERT-VN VU#466521

http://www.debian.org/security/2008/dsa-1574
DEBIAN DSA-1574

http://www.debian.org/security/2008/dsa-1535
DEBIAN DSA-1535

http://sunsolve.sun.com/search/document.do?assetkey=1-26-239546-1
SUNALERT 239546