Your submission was sent successfully! Close

CVE-2008-5913

Published: 20 January 2009

The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."

Priority

Low

Status

Package Release Status
firefox
Launchpad, Ubuntu, Debian
dapper Ignored
(reached end-of-life)
hardy Ignored
(uses system xulrunner)
intrepid Does not exist

jaunty Does not exist

karmic Does not exist

lucid
Released (3.6.6+nobinonly-0ubuntu0.10.04.1)
upstream
Released (3.6.4)
xulrunner-1.9
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Ignored
(reverse dependencies no longer process web content)
intrepid Needed
(reached end-of-life)
jaunty Ignored
(reverse dependencies no longer process web content)
karmic Does not exist

lucid Does not exist

upstream Needed

xulrunner-1.9.1
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Does not exist

intrepid Does not exist

jaunty Ignored
(use firefox-3.0 instead)
karmic Ignored
(reverse dependencies no longer process web content)
lucid Does not exist

upstream Needed

xulrunner-1.9.2
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy
Released (1.9.2.6+nobinonly-0ubuntu0.8.04.1)
intrepid Does not exist

jaunty
Released (1.9.2.7+build2+nobinonly-0ubuntu0.9.04.2)
karmic
Released (1.9.2.7+build2+nobinonly-0ubuntu0.9.10.2)
lucid
Released (1.9.2.6+nobinonly-0ubuntu0.10.04.1)
upstream Needed