CVE-2008-6961

SeaMonkey < 1.1.13 - Exposure of Sensitive Information via DOM Properties

Title source: llm
STIX 2.1

Description

mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the recipient, or comments in forwarded mail, via script that reads the (1) .documentURI or (2) .textContent DOM properties.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/32363
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46734
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=458883
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32715
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021247
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32714

Scores

EPSS 0.0152
EPSS Percentile 71.6%

Details

CWE
CWE-200
Status published
Products (44)
mozilla/seamonkey 1.0 (5 CPE variants)
mozilla/seamonkey 1.0.1
mozilla/seamonkey 1.0.2
mozilla/seamonkey 1.0.3
mozilla/seamonkey 1.0.4
mozilla/seamonkey 1.0.5
mozilla/seamonkey 1.0.6
mozilla/seamonkey 1.0.7
mozilla/seamonkey 1.0.8
mozilla/seamonkey 1.0.9
... and 34 more
Published Aug 13, 2009
Tracked Since Feb 18, 2026