CVE-2008-5503

Description

The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not perform any security checks related to the same-domain policy, which allows remote attackers to read or access data from other domains via crafted XBL bindings.

2.6

CVSS

Severity: Low

CVSS 2.0 •

EPSS 0.84% Top 30%

Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory sun.com Vendor Advisory mandriva.com

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/32882	vdb entry
http://secunia.com/advisories/33408	third party advisory
http://www.debian.org/security/2009/dsa-1697	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11423	signature vdb entry
https://usn.ubuntu.com/690-3/	vendor advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=379959
http://secunia.com/advisories/33205	third party advisory
http://secunia.com/advisories/33421	third party advisory
http://secunia.com/advisories/33232	third party advisory
http://www.vupen.com/english/advisories/2009/0977	vdb entry
http://www.ubuntu.com/usn/usn-690-2	vendor advisory
http://www.ubuntu.com/usn/usn-701-1	vendor advisory
http://secunia.com/advisories/33231	third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:012	vendor advisory
http://secunia.com/advisories/33433	third party advisory
http://www.debian.org/security/2009/dsa-1707	vendor advisory
http://www.securitytracker.com/id?1021424	vdb entry
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1	vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-1037.html	vendor advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-61.html
http://www.debian.org/security/2009/dsa-1704	vendor advisory
http://www.debian.org/security/2009/dsa-1696	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/47409	vdb entry
http://secunia.com/advisories/33204	third party advisory
http://www.ubuntu.com/usn/usn-701-2	vendor advisory
http://secunia.com/advisories/33184	third party advisory
http://www.redhat.com/support/errata/RHSA-2009-0002.html	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:244	vendor advisory
http://secunia.com/advisories/33415	third party advisory
http://secunia.com/advisories/33523	third party advisory
http://secunia.com/advisories/35080	third party advisory
http://secunia.com/advisories/33547	third party advisory
http://secunia.com/advisories/33434	third party advisory
http://secunia.com/advisories/33189	third party advisory
http://secunia.com/advisories/34501	third party advisory

Frequently Asked Questions

What is the severity of CVE-2008-5503?: CVE-2008-5503 has been scored as a low severity vulnerability.
How to fix CVE-2008-5503?: To fix CVE-2008-5503, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2008-5503 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2008-5503 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.