Executive Summary

Informations
Name CVE-2008-5052 First vendor Publication 2008-11-13
Vendor Cve Last vendor Modification 2018-11-02

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5052

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-399 Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:22044
 
Oval ID: oval:org.mitre.oval:def:22044
Title: ELSA-2008:0976: thunderbird security update (Moderate)
Description: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
Family: unix Class: patch
Reference(s): ELSA-2008:0976-01
CVE-2008-5014
CVE-2008-5016
CVE-2008-5017
CVE-2008-5018
CVE-2008-5021
CVE-2008-5012
CVE-2008-5022
CVE-2008-5024
CVE-2008-5052
 Version: 41
Platform(s): Oracle Linux 5
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22309
 
Oval ID: oval:org.mitre.oval:def:22309
Title: ELSA-2008:0978: firefox security update (Critical)
Description: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
Family: unix Class: patch
Reference(s): ELSA-2008:0978-01
CVE-2008-0017
CVE-2008-5014
CVE-2008-5015
CVE-2008-5016
CVE-2008-5017
CVE-2008-5018
CVE-2008-5019
CVE-2008-5021
CVE-2008-5022
CVE-2008-5023
CVE-2008-5024
CVE-2008-5052
 Version: 53
Platform(s): Oracle Linux 5
 Product(s): firefox
nss
devhelp
xulrunner
yelp
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:29116
 
Oval ID: oval:org.mitre.oval:def:29116
Title: RHSA-2008:0976 -- thunderbird security update (Moderate)
Description: Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5021)
Family: unix Class: patch
Reference(s): RHSA-2008:0976
CESA-2008:0976-CentOS 5
CVE-2008-5012
CVE-2008-5014
CVE-2008-5016
CVE-2008-5017
CVE-2008-5018
CVE-2008-5021
CVE-2008-5022
CVE-2008-5024
CVE-2008-5052
 Version: 3
Platform(s): Red Hat Enterprise Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9449
 
Oval ID: oval:org.mitre.oval:def:9449
Title: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
Description: The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
Family: unix Class: vulnerability
Reference(s): CVE-2008-5052
 Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 121
Application 35
Application 74

OpenVAS Exploits

Date Description
2009-10-13 Name : SLES10: Security update for MozillaFirefox
File : nvt/sles10_MozillaFirefox0.nasl
2009-10-13 Name : SLES10: Security update for MozillaFirefox
File : nvt/sles10_MozillaFirefox6.nasl
2009-10-13 Name : SLES10: Security update for gecko-sdk and mozilla-xulrunner
File : nvt/sles10_gecko-sdk0.nasl
2009-04-09 Name : Mandriva Update for mozilla-firefox MDVSA-2008:228 (mozilla-firefox)
File : nvt/gb_mandriva_MDVSA_2008_228.nasl
2009-04-09 Name : Mandriva Update for mozilla-thunderbird MDVSA-2008:235 (mozilla-thunderbird)
File : nvt/gb_mandriva_MDVSA_2008_235.nasl
2009-01-23 Name : SuSE Update for MozillaFirefox,MozillaThunderbird,seamonkey SUSE-SA:2008:055
File : nvt/gb_suse_2008_055.nasl
2008-11-21 Name : Mozilla Firefox Multiple Vulnerabilities November-08 (Linux)
File : nvt/gb_firefox_mult_vuln_nov08_lin.nasl
2008-11-21 Name : Mozilla Firefox Multiple Vulnerabilities November-08 (Win)
File : nvt/gb_firefox_mult_vuln_nov08_win.nasl
2008-11-21 Name : Mozilla Seamonkey Multiple Vulnerabilities November-08 (Linux)
File : nvt/gb_seamonkey_mult_vuln_nov08_lin.nasl
2008-11-21 Name : Mozilla Seamonkey Multiple Vulnerabilities November-08 (Win)
File : nvt/gb_seamonkey_mult_vuln_nov08_win.nasl
2008-11-21 Name : Mozilla Thunderbird Multiple Vulnerabilities November-08 (Linux)
File : nvt/gb_thunderbird_mult_vuln_nov08_lin.nasl
2008-11-21 Name : Mozilla Thunderbird Multiple Vulnerabilities November-08 (Win)
File : nvt/gb_thunderbird_mult_vuln_nov08_win.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
50285 Mozilla Multiple Product JavaScript Engine AppendAttributeValue Function Remo...

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2008-0976.nasl - Type : ACT_GATHER_INFO
2013-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2008-0976.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gecko-sdk-5813.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_MozillaFirefox-5826.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_MozillaThunderbird-081124.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_seamonkey-081122.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_mozilla-xulrunner181-081122.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_MozillaFirefox-081124.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-235.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-228.nasl - Type : ACT_GATHER_INFO
2008-11-26 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gecko-sdk-5811.nasl - Type : ACT_GATHER_INFO
2008-11-25 Name : The remote openSUSE host is missing a security update.
File : suse_MozillaFirefox-5812.nasl - Type : ACT_GATHER_INFO
2008-11-25 Name : The remote openSUSE host is missing a security update.
File : suse_MozillaThunderbird-5825.nasl - Type : ACT_GATHER_INFO
2008-11-25 Name : The remote openSUSE host is missing a security update.
File : suse_mozilla-xulrunner181-5820.nasl - Type : ACT_GATHER_INFO
2008-11-25 Name : The remote openSUSE host is missing a security update.
File : suse_seamonkey-5815.nasl - Type : ACT_GATHER_INFO
2008-11-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_MozillaFirefox-5786.nasl - Type : ACT_GATHER_INFO
2008-11-21 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0976.nasl - Type : ACT_GATHER_INFO
2008-11-20 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_20018.nasl - Type : ACT_GATHER_INFO
2008-11-13 Name : A web browser on the remote host is affected by multiple vulnerabilities.
File : seamonkey_1113.nasl - Type : ACT_GATHER_INFO
2008-11-13 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_20018.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/32281
CERT http://www.us-cert.gov/cas/techalerts/TA08-319A.html
CONFIRM http://www.mozilla.org/security/announce/2008/mfsa2008-52.html
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2008:228
http://www.mandriva.com/security/advisories?name=MDVSA-2008:235
MISC https://bugzilla.mozilla.org/show_bug.cgi?id=454113
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SECTRACK http://www.securitytracker.com/id?1021183
SUSE http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html
VUPEN http://www.vupen.com/english/advisories/2008/3146

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
Date Informations
2024-02-10 01:09:14
  • Multiple Updates
2024-02-02 01:09:42
  • Multiple Updates
2024-02-01 12:02:50
  • Multiple Updates
2023-09-05 12:09:03
  • Multiple Updates
2023-09-05 01:02:41
  • Multiple Updates
2023-09-02 12:09:10
  • Multiple Updates
2023-09-02 01:02:42
  • Multiple Updates
2023-08-12 12:10:47
  • Multiple Updates
2023-08-12 01:02:42
  • Multiple Updates
2023-08-11 12:09:12
  • Multiple Updates
2023-08-11 01:02:47
  • Multiple Updates
2023-08-06 12:08:49
  • Multiple Updates
2023-08-06 01:02:43
  • Multiple Updates
2023-08-04 12:08:54
  • Multiple Updates
2023-08-04 01:02:46
  • Multiple Updates
2023-07-14 12:08:53
  • Multiple Updates
2023-07-14 01:02:43
  • Multiple Updates
2023-03-29 01:10:08
  • Multiple Updates
2023-03-28 12:02:49
  • Multiple Updates
2022-10-11 12:07:54
  • Multiple Updates
2022-10-11 01:02:33
  • Multiple Updates
2021-05-04 12:08:21
  • Multiple Updates
2021-04-22 01:08:43
  • Multiple Updates
2020-10-14 01:04:02
  • Multiple Updates
2020-10-03 01:04:00
  • Multiple Updates
2020-05-29 01:03:41
  • Multiple Updates
2020-05-24 01:05:01
  • Multiple Updates
2020-05-23 00:22:34
  • Multiple Updates
2019-06-25 12:02:22
  • Multiple Updates
2019-01-30 12:02:40
  • Multiple Updates
2018-11-02 17:19:01
  • Multiple Updates
2018-07-13 01:02:51
  • Multiple Updates
2017-11-22 12:02:46
  • Multiple Updates
2017-11-21 12:02:19
  • Multiple Updates
2017-09-29 09:23:49
  • Multiple Updates
2016-06-28 17:20:41
  • Multiple Updates
2016-04-26 18:01:21
  • Multiple Updates
2014-02-17 10:47:15
  • Multiple Updates
2013-05-11 00:30:43
  • Multiple Updates