Your submission was sent successfully! Close

CVE-2008-2808

Published: 07 July 2008

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings, which allows remote attackers to conduct cross-site scripting (XSS) attacks or have unspecified other impact via a crafted filename.

Priority

Low

Status

Package Release Status
firefox
Launchpad, Ubuntu, Debian
Upstream
Released (2.0.0.15)
firefox-3.0
Launchpad, Ubuntu, Debian
Upstream Needs triage

iceape
Launchpad, Ubuntu, Debian
Upstream Needs triage

iceweasel
Launchpad, Ubuntu, Debian
Upstream
Released (2.0.0.15)
seamonkey
Launchpad, Ubuntu, Debian
Upstream
Released (1.1.10)
xulrunner
Launchpad, Ubuntu, Debian
Upstream Needs triage