CVE-2008-3837

Description

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823.

9.3

CVSS

Severity: Critical

CVSS 2.0 •

EPSS 1.31% Top 25%

Vendor Advisory slackware.com Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory slackware.com Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory mozilla.org Vendor Advisory mozilla.org

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/32011	third party advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232	third party advisory vendor advisory
http://www.debian.org/security/2009/dsa-1697	third party advisory vendor advisory
http://secunia.com/advisories/32096	third party advisory
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html	third party advisory vendor advisory
http://www.ubuntu.com/usn/usn-645-1	third party advisory vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45348	vdb entry third party advisory
http://secunia.com/advisories/32144	third party advisory
http://secunia.com/advisories/32010	third party advisory
http://www.vupen.com/english/advisories/2009/0977	vdb entry third party advisory
http://www.ubuntu.com/usn/usn-645-2	third party advisory vendor advisory
http://www.securityfocus.com/bid/31346	vdb entry third party advisory
http://secunia.com/advisories/31985	third party advisory
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html	third party advisory vendor advisory
http://secunia.com/advisories/31984	third party advisory
http://secunia.com/advisories/32185	third party advisory
http://secunia.com/advisories/32196	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9950	vdb entry third party advisory signature
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html	third party advisory vendor advisory
http://www.debian.org/security/2008/dsa-1669	third party advisory vendor advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-40.html	vendor advisory
http://secunia.com/advisories/32042	third party advisory
http://secunia.com/advisories/33433	third party advisory
http://www.vupen.com/english/advisories/2008/2661	vdb entry third party advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422	third party advisory vendor advisory
http://secunia.com/advisories/32095	third party advisory
http://secunia.com/advisories/32089	third party advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1	vendor advisory broken link
http://www.securitytracker.com/id?1020922	vdb entry third party advisory
http://www.redhat.com/support/errata/RHSA-2008-0879.html	third party advisory vendor advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=329385	issue tracking patch vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:205	third party advisory vendor advisory
http://download.novell.com/Download?buildid=WZXONb-tqBw~	third party advisory
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html	third party advisory vendor advisory
http://secunia.com/advisories/31987	third party advisory
http://www.redhat.com/support/errata/RHSA-2008-0882.html	third party advisory vendor advisory
http://secunia.com/advisories/32845	third party advisory
http://www.debian.org/security/2008/dsa-1649	third party advisory vendor advisory
http://secunia.com/advisories/32012	third party advisory
http://secunia.com/advisories/32044	third party advisory
http://secunia.com/advisories/34501	third party advisory

Frequently Asked Questions

What is the severity of CVE-2008-3837?: CVE-2008-3837 has been scored as a critical severity vulnerability.
How to fix CVE-2008-3837?: To fix CVE-2008-3837, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2008-3837 being actively exploited in the wild?: It is possible that CVE-2008-3837 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.