CVE-2008-4066

{"id": "CVE-2008-4066", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-09-24T20:37:04.737", "references": [{"url": "http://blogs.technet.com/bluehat/archive/2008/08/14/targeted-fuzzing.aspx", "tags": ["Exploit"], "source": "secalert@redhat.com"}, {"url": "http://download.novell.com/Download?buildid=WZXONb-tqBw~", "source": "secalert@redhat.com"}, {"url": "http://jvn.jp/en/jp/JVN96950482/index.html", "source": "secalert@redhat.com"}, {"url": "http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000058.html", "source": "secalert@redhat.com"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/31984", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/31985", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32007", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32010", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32012", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32025", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32042", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32044", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32082", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32092", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32144", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32185", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32196", "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/32845", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/34501", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422", "source": "secalert@redhat.com"}, {"url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232", "source": "secalert@redhat.com"}, {"url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123", "source": "secalert@redhat.com"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1", "source": "secalert@redhat.com"}, {"url": "http://www.debian.org/security/2008/dsa-1649", "source": "secalert@redhat.com"}, {"url": "http://www.debian.org/security/2008/dsa-1669", "source": "secalert@redhat.com"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:205", "source": "secalert@redhat.com"}, {"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:206", "source": "secalert@redhat.com"}, {"url": "http://www.mozilla.org/security/announce/2008/mfsa2008-43.html", "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2008-0882.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2008-0908.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/31346", "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id?1020920", "source": "secalert@redhat.com"}, {"url": "http://www.thespanner.co.uk/2008/06/30/javascript-protocol-fuzz-results/", "tags": ["Exploit"], "source": "secalert@redhat.com"}, {"url": "http://www.ubuntu.com/usn/usn-645-1", "source": "secalert@redhat.com"}, {"url": "http://www.ubuntu.com/usn/usn-645-2", "source": "secalert@redhat.com"}, {"url": "http://www.ubuntu.com/usn/usn-647-1", "source": "secalert@redhat.com"}, {"url": "http://www.vupen.com/english/advisories/2008/2661", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.vupen.com/english/advisories/2009/0977", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=448166", "source": "secalert@redhat.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45358", "source": "secalert@redhat.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8880", "source": "secalert@redhat.com"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a \"jav&#56325ascript\" sequence, aka \"HTML escaped low surrogates bug.\""}, {"lang": "es", "value": "Mozilla Firefox versi\u00f3n 2.0.0.14, y otras versiones anteriores a 2.0.0.17, permiten a los atacantes remotos omitir los mecanismos de protecci\u00f3n de cross-site scripting (XSS) y conducir ataques de tipo XSS por medio de caracteres sustitutos bajos con escape de HTML que son ignorados por el analizador HTML, como es demostrado por una secuencia \"jav?ascript\", tambi\u00e9n se conoce como \"HTML escaped low surrogates bug.\""}], "lastModified": "2017-09-29T01:31:58.493", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:2.0.0.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "863C140E-DC15-4A88-AB8A-8AEF9F4B8164"}, {"criteria": "cpe:2.3:a:mozilla:firefox:2.0.0.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38CD049A-5333-4FF7-AD34-6B74E19BADCB"}, {"criteria": "cpe:2.3:a:mozilla:firefox:2.0.0.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0066576D-D66A-4B59-B5C3-471EEBEE8B9A"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}