Vulnerabilities > Mozilla > Firefox > 2.0.0.17

DATE CVE VULNERABILITY TITLE RISK
2008-12-17 CVE-2008-5502 Resource Management Errors vulnerability in multiple products
The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corruption, related to the GetXMLEntity and FastAppendChar functions.
network
low complexity
mozilla canonical CWE-399
5.0
2008-12-17 CVE-2008-5501 Remote vulnerability in Mozilla Firefox/Thunderbird/SeaMonkey
The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service via vectors that trigger an assertion failure.
network
low complexity
mozilla canonical
5.0
2008-12-17 CVE-2008-5500 Resource Management Errors vulnerability in multiple products
The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to (1) a reachable assertion or (2) an integer overflow.
network
low complexity
mozilla canonical debian CWE-399
critical
10.0
2008-11-13 CVE-2008-5052 Resource Management Errors vulnerability in Mozilla Firefox, Seamonkey and Thunderbird
The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.
network
low complexity
mozilla CWE-399
critical
10.0
2008-11-13 CVE-2008-5024 XML Injection (Aka Blind Xpath Injection) vulnerability in multiple products
Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.
network
low complexity
mozilla debian canonical CWE-91
7.5
2008-11-13 CVE-2008-5023 Improper Input Validation vulnerability in multiple products
Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.
network
low complexity
mozilla debian canonical CWE-20
7.5
2008-11-13 CVE-2008-5022 Improper Authentication vulnerability in multiple products
The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.
network
low complexity
mozilla debian canonical CWE-287
7.5
2008-11-13 CVE-2008-5018 Resource Management Errors vulnerability in multiple products
The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via vectors related to "insufficient class checking" in the Date class.
network
low complexity
mozilla debian canonical CWE-399
critical
10.0
2008-11-13 CVE-2008-5017 Numeric Errors vulnerability in multiple products
Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors.
network
low complexity
mozilla debian canonical CWE-189
critical
10.0
2008-11-13 CVE-2008-5015 Code Injection vulnerability in Mozilla Firefox
Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system.
network
high complexity
mozilla CWE-94
5.1