CVE-2008-5013

Firefox < 2.0.0.18 - Remote Code Execution via Flash Module Unload Bypass

Title source: llm
STIX 2.1

Description

Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.

References (26)

Core 26
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/3146
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2009/dsa-1697
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1671
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32281
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0977.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0977
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1669
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32778
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33433
Issue Tracking x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=433610
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32694
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA08-319A.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32853
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9660
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32693
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021181
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:228
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32845
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32684
Various Sources vendor-advisory x_refsource_ubuntu
http://ubuntu.com/usn/usn-667-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32714
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34501

Scores

EPSS 0.0481
EPSS Percentile 91.0%

Details

CWE
CWE-399
Status published
Products (46)
mozilla/firefox 0.8
mozilla/firefox 0.9 (2 CPE variants)
mozilla/firefox 0.9.1
mozilla/firefox 0.9.2
mozilla/firefox 0.9.3
mozilla/firefox 0.9_rc
mozilla/firefox 0.10
mozilla/firefox 0.10.1
mozilla/firefox 1.0
mozilla/firefox 1.0.1
... and 36 more
Published Nov 13, 2008
Tracked Since Feb 18, 2026