Vulnerability Name:

CVE-2008-1237 (CCN-41446)

Assigned:2008-03-25
Published:2008-03-25
Updated:2018-10-11
Summary:Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-399
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-1237

Source: SUSE
Type: UNKNOWN
SUSE-SA:2008:019

Source: SUSE
Type: UNKNOWN
SUSE-SR:2008:011

Source: CCN
Type: RHSA-2008-0207
Critical: firefox security update

Source: CCN
Type: RHSA-2008-0208
Critical: seamonkey security update

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0208

Source: CCN
Type: RHSA-2008-0209
Moderate: thunderbird security update

Source: SECUNIA
Type: UNKNOWN
29391

Source: CCN
Type: SA29526
Mozilla Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
29526

Source: SECUNIA
Type: UNKNOWN
29539

Source: SECUNIA
Type: UNKNOWN
29541

Source: CCN
Type: SA29547
Mozilla SeaMonkey Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
29547

Source: CCN
Type: SA29548
Mozilla Thunderbird Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
29548

Source: SECUNIA
Type: UNKNOWN
29550

Source: SECUNIA
Type: UNKNOWN
29558

Source: SECUNIA
Type: UNKNOWN
29560

Source: SECUNIA
Type: UNKNOWN
29607

Source: SECUNIA
Type: UNKNOWN
29616

Source: SECUNIA
Type: UNKNOWN
29645

Source: SECUNIA
Type: UNKNOWN
30016

Source: SECUNIA
Type: UNKNOWN
30094

Source: SECUNIA
Type: UNKNOWN
30105

Source: SECUNIA
Type: UNKNOWN
30192

Source: SECUNIA
Type: UNKNOWN
30327

Source: SECUNIA
Type: UNKNOWN
30370

Source: CCN
Type: SA30620
Sun Solaris Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
30620

Source: CCN
Type: SA31043
Sun Solaris Thunderbird Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
31043

Source: CCN
Type: SECTRACK ID: 1019695
Mozilla Firefox Bugs in JavaScript Engine and Layout Engine May Let Remote Users Execute Arbitrary Code

Source: SUNALERT
Type: UNKNOWN
238492

Source: SUNALERT
Type: UNKNOWN
239546

Source: CCN
Type: Sun Alert ID: 238492
Multiple Security Vulnerabilities in Solaris 10 Firefox may Allow Execution of Arbitrary Code and Access to Unauthorized Data

Source: CCN
Type: Sun Alert ID: 239546
Security Vulnerabilities in Thunderbird for Solaris May Result in Privilege Escalation or Cross-Site Scripting (XSS)

Source: CCN
Type: ASA-2008-142
firefox security update (RHSA-2008-0207)

Source: CCN
Type: ASA-2008-143
seamonkey security update (RHSA-2008-0208)

Source: CCN
Type: ASA-2008-146
thunderbird security update (RHSA-2008-0209)

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128

Source: DEBIAN
Type: UNKNOWN
DSA-1532

Source: DEBIAN
Type: UNKNOWN
DSA-1534

Source: DEBIAN
Type: UNKNOWN
DSA-1535

Source: DEBIAN
Type: UNKNOWN
DSA-1574

Source: DEBIAN
Type: DSA-1532
xulrunner -- several vulnerabilities

Source: DEBIAN
Type: DSA-1534
iceape -- several vulnerabilities

Source: DEBIAN
Type: DSA-1535
iceweasel -- several vulnerabilities

Source: DEBIAN
Type: DSA-1574
icedove -- several vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200805-18

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:080

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:155

Source: CCN
Type: MFSA 2008-15
Crashes with evidence of memory corruption (rv:1.8.1.13)

Source: CONFIRM
Type: UNKNOWN
http://www.mozilla.org/security/announce/2008/mfsa2008-15.html

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0207

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0209

Source: BUGTRAQ
Type: UNKNOWN
20080327 rPSA-2008-0128-1 firefox

Source: BID
Type: UNKNOWN
28448

Source: CCN
Type: BID-28448
Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12 Multiple Remote Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1019695

Source: SLACKWARE
Type: UNKNOWN
SSA:2008-128-02

Source: CCN
Type: USN-592-1
Firefox vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-592-1

Source: CCN
Type: USN-605-1
Thunderbird vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-605-1

Source: CERT
Type: US Government Resource
TA08-087A

Source: VUPEN
Type: UNKNOWN
ADV-2008-0998

Source: VUPEN
Type: UNKNOWN
ADV-2008-0999

Source: VUPEN
Type: UNKNOWN
ADV-2008-1793

Source: VUPEN
Type: UNKNOWN
ADV-2008-2091

Source: XF
Type: UNKNOWN
firefox-javascript-engine-code-execution(41446)

Source: XF
Type: UNKNOWN
firefox-javascript-engine-code-execution(41446)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9651

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-3519

Source: FEDORA
Type: UNKNOWN
FEDORA-2008-3557

Source: SUSE
Type: SUSE-SA:2008:019
Mozilla Firefox security update

Source: SUSE
Type: SUSE-SR:2008:011
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version <= 2.0.0.12)
  • OR cpe:/a:mozilla:seamonkey:*:*:*:*:*:*:*:* (Version <= 1.1.8)
  • OR cpe:/a:mozilla:thunderbird:*:*:*:*:*:*:*:* (Version <= 2.0.0.12)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/a:redhat:rhel_productivity:5:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:2.0.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1::beta:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:x86_64:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.6.z:ga:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.6.z:ga:es:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:8.04::lts:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_89::x86:*:*:*:*:*
  • OR cpe:/o:sun:opensolaris:build_snv_89::sparc:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20081237
    V
    		CVE-2008-1237
    2015-11-16
    oval:org.mitre.oval:def:17490
    P
    		USN-605-1 -- mozilla-thunderbird, thunderbird vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:17694
    P
    		USN-592-1 -- firefox vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:18655
    P
    		DSA-1574-1 icedove - several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:7395
    P
    		DSA-1535 iceweasel -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:20297
    P
    		DSA-1535-1 iceweasel
    2014-06-23
    oval:org.mitre.oval:def:18729
    P
    		DSA-1534-1 iceape
    2014-06-23
    oval:org.mitre.oval:def:7681
    P
    		DSA-1574 icedove -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:18755
    P
    		DSA-1532-1 xulrunner
    2014-06-23
    oval:org.mitre.oval:def:7869
    P
    		DSA-1534 iceape -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:19906
    P
    		DSA-1534-2 iceape - regression
    2014-06-23
    oval:org.mitre.oval:def:7955
    P
    		DSA-1532 xulrunner -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:22699
    P
    		ELSA-2008:0209: thunderbird security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:22714
    P
    		ELSA-2008:0207: firefox security update (Critical)
    2014-05-26
    oval:org.mitre.oval:def:9651
    V
    		Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.
    2013-04-29
    oval:org.debian:def:1574
    V
    		several vulnerabilities
    2008-05-12
    oval:com.redhat.rhsa:def:20080209
    P
    		RHSA-2008:0209: thunderbird security update (Moderate)
    2008-04-03
    oval:org.debian:def:1535
    V
    		several vulnerabilities
    2008-03-30
    oval:org.debian:def:1534
    V
    		several vulnerabilities
    2008-03-28
    oval:com.redhat.rhsa:def:20080207
    P
    		RHSA-2008:0207: firefox security update (Critical)
    2008-03-27
    oval:com.redhat.rhsa:def:20080208
    P
    		RHSA-2008:0208: seamonkey security update (Critical)
    2008-03-27
    oval:org.debian:def:1532
    V
    		several vulnerabilities
    2008-03-27
    BACK
    mozilla firefox *
    mozilla seamonkey *
    mozilla thunderbird *
    mozilla firefox 2.0
    mozilla firefox 2.0.0.1
    mozilla firefox 2.0.0.2
    mozilla firefox 2.0.0.3
    mozilla firefox 2.0.0.4
    mozilla firefox 2.0.0.5
    mozilla thunderbird 2.0.0.5
    mozilla seamonkey 1.1.3
    mozilla firefox 2.0.0.6
    mozilla firefox 2.0.0.9
    mozilla thunderbird 2.0.0.4
    mozilla thunderbird 2.0.0.3
    mozilla thunderbird 2.0.0.2
    mozilla thunderbird 2.0.0.1
    mozilla seamonkey 1.1.2
    mozilla seamonkey 1.1.1
    mozilla firefox 2.0.0.7
    mozilla thunderbird 2.0.0.6
    mozilla thunderbird 2.0.0.7
    mozilla seamonkey 1.1.4
    mozilla firefox 2.0.0.8
    mozilla seamonkey 1.1.5
    mozilla seamonkey 1.1.6
    mozilla firefox 2.0.0.11
    mozilla firefox 2.0.0.12
    mozilla thunderbird 2.0.0.9
    mozilla firefox 2.0.0.10
    mozilla thunderbird 2.0.0.0
    mozilla thunderbird 2.0.0.11
    mozilla thunderbird 2.0.0.12
    mozilla thunderbird 2.0.0.8
    mozilla seamonkey 1.1
    mozilla seamonkey 1.1.7
    mozilla seamonkey 1.1.8
    mozilla seamonkey 1.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    sun solaris 10
    sun solaris 10
    redhat linux advanced workstation 2.1
    canonical ubuntu 6.06
    novell suse linux enterprise server 10 sp2
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 5
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2007.1
    mandrakesoft mandrake linux 2008.0
    debian debian linux 4.0
    canonical ubuntu 7.04
    redhat enterprise linux 5
    canonical ubuntu 7.10
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.1 x86_64
    mandrakesoft mandrake linux 2007.1
    redhat enterprise linux 4.6.z ga
    redhat enterprise linux 4.6.z ga
    novell opensuse 10.2
    novell opensuse 10.3
    mandrakesoft mandrake linux 2008.1
    canonical ubuntu 8.04
    sun opensolaris build_snv_89
    sun opensolaris build_snv_89