CVE-2008-5510

Description

The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 1.13% Top 25%

Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory sun.com Vendor Advisory sun.com Vendor Advisory mandriva.com Vendor Advisory mozilla.org Vendor Advisory mozilla.org

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/32882	vdb entry third party advisory
http://www.securitytracker.com/id?1021425	vdb entry third party advisory
http://secunia.com/advisories/33408	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9662	vdb entry third party advisory signature
http://secunia.com/advisories/33205	third party advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=228856	issue tracking vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-1036.html	third party advisory vendor advisory
http://www.vupen.com/english/advisories/2009/0977	vdb entry third party advisory
http://www.ubuntu.com/usn/usn-690-2	third party advisory vendor advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-67.html	vendor advisory
http://www.ubuntu.com/usn/usn-701-1	third party advisory vendor advisory
http://secunia.com/advisories/33231	third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:245	third party advisory vendor advisory
https://usn.ubuntu.com/690-1/	third party advisory vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:012	third party advisory vendor advisory
http://secunia.com/advisories/33203	third party advisory
http://www.debian.org/security/2009/dsa-1707	third party advisory vendor advisory
http://secunia.com/advisories/33216	third party advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1	vendor advisory broken link
http://secunia.com/advisories/33204	third party advisory
http://secunia.com/advisories/33184	third party advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1	vendor advisory broken link
http://www.mandriva.com/security/advisories?name=MDVSA-2008:244	third party advisory vendor advisory
http://secunia.com/advisories/33188	third party advisory
http://secunia.com/advisories/33523	third party advisory
http://secunia.com/advisories/35080	third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/47415	vdb entry third party advisory
http://secunia.com/advisories/34501	third party advisory

Frequently Asked Questions

What is the severity of CVE-2008-5510?: CVE-2008-5510 has been scored as a medium severity vulnerability.
How to fix CVE-2008-5510?: To fix CVE-2008-5510, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2008-5510 being actively exploited in the wild?: It is possible that CVE-2008-5510 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.