CVE-2008-5052

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-399

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:228Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:235Third Party Advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-52.htmlVendor Advisory
http://www.securityfocus.com/bid/32281Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1021183Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-319A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/3146Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=454113Issue Tracking, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9449Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.htmlThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:228Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:235Third Party Advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-52.htmlVendor Advisory
http://www.securityfocus.com/bid/32281Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1021183Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-319A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/3146Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=454113Issue Tracking, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9449Third Party Advisory

Timeline

Published: Nov 13, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-505310.0PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows rem CVE-2008-50547.5Multiple SQL injection vulnerabilities in Develop It Easy Membership System 1.3 allow remote attackers to execute arbitrary SQL commands via CVE-2008-50557.5SQL injection vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers to execute ar CVE-2008-50564.3Cross-site scripting (XSS) vulnerability in department_offline_context.php in ActiveCampaign TrioLive before 1.58.7 allows remote attackers CVE-2008-50577.5SQL injection vulnerability in film.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the film CVE-2008-50587.5SQL injection vulnerability in siteadmin/loginsucess.php in Pre Simple CMS allows remote attackers to execute arbitrary SQL commands via the CVE-2008-50594.3Cross-site scripting (XSS) vulnerability in index.php in ModernBill 4.4 and earlier allows remote attackers to inject arbitrary web script o CVE-2008-506010.0Multiple PHP remote file inclusion vulnerabilities in ModernBill 4.4 and earlier allow remote attackers to execute arbitrary PHP code via a CVE-2008-50614.3Cross-site scripting (XSS) vulnerability in php/cal_default.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to inject arbitrary CVE-2008-50625.0Directory traversal vulnerability in php/cal_pdf.php in Mini Web Calendar (mwcal) 1.2 allows remote attackers to read arbitrary files via di CVE-2008-506310.0PHP remote file inclusion vulnerability in Admin/ADM_Pagina.php in OTManager 2.4 allows remote attackers to execute arbitrary PHP code via a CVE-2008-50647.5SQL injection vulnerability in liga.php in H&H WebSoccer 2.80 allows remote attackers to execute arbitrary SQL commands via the id parameter