Executive Summary

Informations
Name CVE-2008-4070 First vendor Publication 2008-09-27
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4070

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10933
 
Oval ID: oval:org.mitre.oval:def:10933
Title: Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."
Description: Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."
Family: unix Class: vulnerability
Reference(s): CVE-2008-4070
 Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17610
 
Oval ID: oval:org.mitre.oval:def:17610
Title: USN-647-1 -- mozilla-thunderbird, thunderbird vulnerabilities
Description: It was discovered that the same-origin check in Thunderbird could be bypassed.
Family: unix Class: patch
Reference(s): USN-647-1
CVE-2008-3835
CVE-2008-4058
CVE-2008-4059
CVE-2008-4060
CVE-2008-4061
CVE-2008-4062
CVE-2008-4063
CVE-2008-4064
CVE-2008-4065
CVE-2008-4066
CVE-2008-4067
CVE-2008-4068
CVE-2008-4070
 Version: 7
Platform(s): Ubuntu 6.06
Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04
 Product(s): mozilla-thunderbird
thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22664
 
Oval ID: oval:org.mitre.oval:def:22664
Title: ELSA-2008:0908: thunderbird security update (Moderate)
Description: Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."
Family: unix Class: patch
Reference(s): ELSA-2008:0908-01
CVE-2008-0016
CVE-2008-3835
CVE-2008-4058
CVE-2008-4059
CVE-2008-4060
CVE-2008-4061
CVE-2008-4062
CVE-2008-4065
CVE-2008-4066
CVE-2008-4067
CVE-2008-4068
CVE-2008-4070
 Version: 53
Platform(s): Oracle Linux 5
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28693
 
Oval ID: oval:org.mitre.oval:def:28693
Title: RHSA-2008:0908 -- thunderbird security update (Moderate)
Description: Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062)
Family: unix Class: patch
Reference(s): RHSA-2008:0908
CESA-2008:0908-CentOS 5
CVE-2008-0016
CVE-2008-3835
CVE-2008-4058
CVE-2008-4059
CVE-2008-4060
CVE-2008-4061
CVE-2008-4062
CVE-2008-4065
CVE-2008-4066
CVE-2008-4067
CVE-2008-4068
CVE-2008-4070
 Version: 3
Platform(s): Red Hat Enterprise Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): thunderbird
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 33
Application 75

OpenVAS Exploits

Date Description
2009-06-03 Name : Solaris Update for Mozilla 1.7 125539-06
File : nvt/gb_solaris_125539_06.nasl
2009-06-03 Name : Solaris Update for Mozilla Firefox Web browser 125540-06
File : nvt/gb_solaris_125540_06.nasl
2009-04-09 Name : Mandriva Update for mozilla-thunderbird MDVSA-2008:206 (mozilla-thunderbird)
File : nvt/gb_mandriva_MDVSA_2008_206.nasl
2009-03-23 Name : Ubuntu Update for mozilla-thunderbird, thunderbird vulnerabilities USN-647-1
File : nvt/gb_ubuntu_USN_647_1.nasl
2009-03-06 Name : RedHat Update for thunderbird RHSA-2008:0908-01
File : nvt/gb_RHSA-2008_0908-01_thunderbird.nasl
2009-02-27 Name : CentOS Update for thunderbird CESA-2008:0908 centos4 i386
File : nvt/gb_CESA-2008_0908_thunderbird_centos4_i386.nasl
2009-02-27 Name : CentOS Update for thunderbird CESA-2008:0908 centos4 x86_64
File : nvt/gb_CESA-2008_0908_thunderbird_centos4_x86_64.nasl
2009-02-17 Name : Fedora Update for thunderbird FEDORA-2008-9807
File : nvt/gb_fedora_2008_9807_thunderbird_fc8.nasl
2009-02-17 Name : Fedora Update for thunderbird FEDORA-2008-9859
File : nvt/gb_fedora_2008_9859_thunderbird_fc9.nasl
2009-01-23 Name : SuSE Update for MozillaFirefox,MozillaThunderbird,seamonkey,mozilla SUSE-SA:...
File : nvt/gb_suse_2008_050.nasl
2009-01-13 Name : Debian Security Advisory DSA 1696-1 (icedove)
File : nvt/deb_1696_1.nasl
2009-01-13 Name : Debian Security Advisory DSA 1697-1 (iceape)
File : nvt/deb_1697_1.nasl
0000-00-00 Name : Slackware Advisory SSA:2008-269-02 seamonkey
File : nvt/esoft_slk_ssa_2008_269_02.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
48772 Mozilla Multiple Products News Article Header Handling Overflow

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2008-0908.nasl - Type : ACT_GATHER_INFO
2013-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing a security update.
File : sl_20081001_thunderbird_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_MozillaThunderbird-081003.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-206.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-647-1.nasl - Type : ACT_GATHER_INFO
2009-01-08 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1697.nasl - Type : ACT_GATHER_INFO
2009-01-08 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1696.nasl - Type : ACT_GATHER_INFO
2008-11-21 Name : The remote Fedora host is missing a security update.
File : fedora_2008-9859.nasl - Type : ACT_GATHER_INFO
2008-11-21 Name : The remote Fedora host is missing a security update.
File : fedora_2008-9807.nasl - Type : ACT_GATHER_INFO
2008-10-06 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2008-0908.nasl - Type : ACT_GATHER_INFO
2008-10-06 Name : The remote openSUSE host is missing a security update.
File : suse_MozillaThunderbird-5655.nasl - Type : ACT_GATHER_INFO
2008-10-02 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0908.nasl - Type : ACT_GATHER_INFO
2008-09-28 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2008-270-01.nasl - Type : ACT_GATHER_INFO
2008-09-26 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2008-269-02.nasl - Type : ACT_GATHER_INFO
2008-09-26 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_20017.nasl - Type : ACT_GATHER_INFO
2008-09-24 Name : A web browser on the remote host is affected by multiple vulnerabilities.
File : seamonkey_1112.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html
http://secunia.com/advisories/32010
http://secunia.com/advisories/32025
http://secunia.com/advisories/32044
http://secunia.com/advisories/32082
http://secunia.com/advisories/32092
http://secunia.com/advisories/32196
http://secunia.com/advisories/33433
http://secunia.com/advisories/33434
http://secunia.com/advisories/34501
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&...
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&...
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
http://www.debian.org/security/2009/dsa-1696
http://www.debian.org/security/2009/dsa-1697
http://www.mandriva.com/security/advisories?name=MDVSA-2008:206
http://www.mozilla.org/security/announce/2008/mfsa2008-46.html
http://www.redhat.com/support/errata/RHSA-2008-0908.html
http://www.securityfocus.com/bid/31411
http://www.securitytracker.com/id?1020948
http://www.ubuntu.com/usn/usn-647-1
http://www.vupen.com/english/advisories/2009/0977
https://bugzilla.mozilla.org/show_bug.cgi?id=425152
https://exchange.xforce.ibmcloud.com/vulnerabilities/45426
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
Date Informations
2025-02-07 01:10:27
  • Multiple Updates
2024-11-28 23:13:25
  • Multiple Updates
2024-11-28 12:16:29
  • Multiple Updates
2024-08-02 12:09:46
  • Multiple Updates
2024-08-02 01:02:47
  • Multiple Updates
2024-02-02 01:09:20
  • Multiple Updates
2024-02-01 12:02:46
  • Multiple Updates
2023-09-05 12:08:42
  • Multiple Updates
2023-09-05 01:02:37
  • Multiple Updates
2023-09-02 12:08:49
  • Multiple Updates
2023-09-02 01:02:38
  • Multiple Updates
2023-08-12 12:10:24
  • Multiple Updates
2023-08-12 01:02:38
  • Multiple Updates
2023-08-11 12:08:51
  • Multiple Updates
2023-08-11 01:02:43
  • Multiple Updates
2023-08-06 12:08:28
  • Multiple Updates
2023-08-06 01:02:39
  • Multiple Updates
2023-08-04 12:08:34
  • Multiple Updates
2023-08-04 01:02:42
  • Multiple Updates
2023-07-14 12:08:33
  • Multiple Updates
2023-07-14 01:02:39
  • Multiple Updates
2023-03-29 01:09:45
  • Multiple Updates
2023-03-28 12:02:45
  • Multiple Updates
2022-10-11 12:07:35
  • Multiple Updates
2022-10-11 01:02:29
  • Multiple Updates
2021-05-04 12:08:02
  • Multiple Updates
2021-04-22 01:08:23
  • Multiple Updates
2020-05-24 01:04:45
  • Multiple Updates
2020-05-23 00:22:15
  • Multiple Updates
2019-06-25 12:02:18
  • Multiple Updates
2019-01-30 12:02:37
  • Multiple Updates
2018-07-13 01:02:48
  • Multiple Updates
2017-11-21 12:02:15
  • Multiple Updates
2017-09-29 09:23:43
  • Multiple Updates
2017-08-08 09:24:23
  • Multiple Updates
2016-06-28 17:17:56
  • Multiple Updates
2016-04-26 17:49:22
  • Multiple Updates
2014-02-17 10:46:34
  • Multiple Updates
2013-05-11 00:26:01
  • Multiple Updates
2012-11-07 00:18:11
  • Multiple Updates