Vulnerability Description
Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 2.0.0.17 |
| Mozilla | Seamonkey | <= 1.1.12 |
| Mozilla | Thunderbird | <= 2.0.0.17 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html
- http://scary.beasts.org/security/CESA-2008-009.html
- http://scarybeastsecurity.blogspot.com/2008/11/firefox-cross-domain-image-theft-
- http://secunia.com/advisories/32684
- http://secunia.com/advisories/32693
- http://secunia.com/advisories/32694
- http://secunia.com/advisories/32714
- http://secunia.com/advisories/32715
- http://secunia.com/advisories/32778
- http://secunia.com/advisories/32798
- http://secunia.com/advisories/32845
- http://secunia.com/advisories/32853
- http://secunia.com/advisories/33433
- http://secunia.com/advisories/33434
- http://secunia.com/advisories/34501
FAQ
What is CVE-2008-5012?
CVE-2008-5012 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which...
How severe is CVE-2008-5012?
CVE-2008-5012 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-5012?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird.