Vulnerabilities > CVE-2008-2934 - Use of Uninitialized Resource vulnerability in multiple products

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
apple
canonical
CWE-908
nessus
NVD
Published: 2008-07-18
Updated: 2024-11-21

Summary

Mozilla Firefox 3 before 3.0.1 on Mac OS X allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted GIF file that triggers a free of an uninitialized pointer.

Vulnerable Configurations

Part Description Count
Application
Mozilla
1
OS
Apple
1
OS
Canonical
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-626-1.NASL
    descriptionA flaw was discovered in the browser engine. A variable could be made to overflow causing the browser to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2785) Billy Rios discovered that Firefox and xulrunner, as used by browsers such as Epiphany, did not properly perform URI splitting with pipe symbols when passed a command-line URI. If Firefox or xulrunner were passed a malicious URL, an attacker may be able to execute local content with chrome privileges. (CVE-2008-2933). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id33758
    published2008-07-29
    reporterUbuntu Security Notice (C) 2008-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/33758
    titleUbuntu 8.04 LTS : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-626-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_MOZILLAFIREFOX-080731.NASL
    descriptionThis update brings Mozilla Firefox to version 3.0.1. It fixes various bugs and also following security problems : MFSA 2008-34 / CVE-2008-2785: An anonymous researcher, via TippingPoint
    last seen2020-06-01
    modified2020-06-02
    plugin id39882
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39882
    titleopenSUSE Security Update : MozillaFirefox (MozillaFirefox-125)

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 30266 CVE(CAN) ID: CVE-2008-2934 Firefox是一款流行的开源WEB浏览器。 Mozilla用于在Mac OS X平台上渲染GIF图形的代码中存在漏洞，如果用户受骗打开了特制的GIF图形的话，就会释放未初始化的指针，导致拒绝服务或执行任意指令。 Mozilla Firefox 3.0 Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://www.mozilla.com/en-US/firefox/ target=_blank>http://www.mozilla.com/en-US/firefox/</a>
idSSV:3681
last seen2017-11-19
modified2008-07-18
published2008-07-18
reporterRoot
titleMac OS X平台上Firefox GIF图形渲染内存破坏漏洞

Statements

contributorTomas Hoger
lastmodified2008-07-21
organizationRed Hat
statementNot vulnerable. This issue did not affect the versions of firefox as shipped with Red Hat Enterprise Linux 4, or 5.

References