CVE-2008-4582
NoneCVSS
—
EPSS
10.2%
Published
Oct 15, 2008
CISA due date
—
The record
Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | iceape | 0 | 1.0.13~pre080614i-0etch1 |
| Debian:4.0 | icedove | 0 | 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1 |
| Debian:4.0 | iceweasel | 0 | 2.0.0.18-0etch1 |
| Debian:4.0 | xulrunner | 0 | 1.8.0.15~pre080614h-0etch1 |
Related vulnerabilities
- CVE-2008-0016 Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before… Also affects iceape
- CVE-2008-2798 Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird… Also affects iceape
- CVE-2007-4041 Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow… Also affects iceape
- CVE-2007-2292 CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox… Also affects iceape
- CVE-2026-81644 DoS vulnerability in the preview service module. CWE-264
- CVE-2026-49315 DoS vulnerability in the input device module. CWE-264
- CVE-2026-49313 Permission control vulnerability in the app lock module. CWE-264
- CVE-2026-49312 Permission control vulnerability in the window module. CWE-264