{"api_version":"1","generated_at":"2026-07-23T04:31:10+00:00","cve":"CVE-2008-4068","urls":{"html":"https://cve.report/CVE-2008-4068","api":"https://cve.report/api/cve/CVE-2008-4068.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4068","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4068"},"summary":{"title":"CVE-2008-4068","description":"Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass \"restrictions imposed on local HTML files,\" and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.","state":"PUBLISHED","assigner":"redhat","published_at":"2008-09-24 20:37:04","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-22","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:N/A:N","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123","name":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"The Slackware Linux Project: Slackware Security Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html","name":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"[SECURITY] Fedora 8 Update: seamonkey-1.1.12-1.fc8","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32845","name":"http://secunia.com/advisories/32845","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian update for xulrunner - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html","name":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"[SECURITY] Fedora 9 Update: xulrunner-1.9.0.2-1.fc9","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2009/dsa-1696","name":"http://www.debian.org/security/2009/dsa-1696","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-1696-1 icedove","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2009/0977","name":"http://www.vupen.com/english/advisories/2009/0977","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","name":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://secunia.com/advisories/32095","name":"http://secunia.com/advisories/32095","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Fedora update for firefox and xulrunner - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32012","name":"http://secunia.com/advisories/32012","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Ubuntu update for firefox and xulrunner - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://download.novell.com/Download?buildid=WZXONb-tqBw~","name":"http://download.novell.com/Download?buildid=WZXONb-tqBw~","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Downloads","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32044","name":"http://secunia.com/advisories/32044","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Slackware update for seamonkey - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html","name":"http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"[security-announce] SUSE Security Announcement: Mozilla (SUSE-SA:2008:05","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/usn-645-2","name":"http://www.ubuntu.com/usn/usn-645-2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-645-2: Firefox vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2008/dsa-1669","name":"http://www.debian.org/security/2008/dsa-1669","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-1669-1 xulrunner","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32011","name":"http://secunia.com/advisories/32011","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Mozilla Firefox 3 Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32096","name":"http://secunia.com/advisories/32096","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Fedora update for firefox - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32185","name":"http://secunia.com/advisories/32185","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian update for iceweasel - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:206","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:206","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Support / Security / Advisories /  / MDVSA-2008:206 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/usn-645-1","name":"http://www.ubuntu.com/usn/usn-645-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-645-1: Firefox and xulrunner vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-44.html","name":"http://www.mozilla.org/security/announce/2008/mfsa2008-44.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"MFSA 2008-44: resource: traversal vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2009/dsa-1697","name":"http://www.debian.org/security/2009/dsa-1697","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-1697-1 iceape","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0879.html","name":"http://www.redhat.com/support/errata/RHSA-2008-0879.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32092","name":"http://secunia.com/advisories/32092","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA32092 - Red Hat update for thunderbird - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/31985","name":"http://secunia.com/advisories/31985","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA31985 - Red Hat update for seamonkey - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32007","name":"http://secunia.com/advisories/32007","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Mozilla Thunderbird Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2661","name":"http://www.vupen.com/english/advisories/2008/2661","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0908.html","name":"http://www.redhat.com/support/errata/RHSA-2008-0908.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Support | Red Hat","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/33433","name":"http://secunia.com/advisories/33433","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian update for iceape - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32082","name":"http://secunia.com/advisories/32082","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Slackware update for mozilla-thunderbird - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422","name":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"The Slackware Linux Project: Slackware Security Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/31346","name":"http://www.securityfocus.com/bid/31346","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ubuntu.com/usn/usn-647-1","name":"http://www.ubuntu.com/usn/usn-647-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-647-1: Thunderbird vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/31987","name":"http://secunia.com/advisories/31987","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA31987 - Red Hat update for firefox - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32025","name":"http://secunia.com/advisories/32025","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA32025 - Ubuntu update for thunderbird - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/34501","name":"http://secunia.com/advisories/34501","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Sun Solaris Firefox Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32144","name":"http://secunia.com/advisories/32144","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA32144 - SUSE update for MozillaFirefox - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2008/dsa-1649","name":"http://www.debian.org/security/2008/dsa-1649","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-1649-1 iceweasel","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32089","name":"http://secunia.com/advisories/32089","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Fedora update for seamonkey - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0882.html","name":"http://www.redhat.com/support/errata/RHSA-2008-0882.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232","name":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"The Slackware Linux Project: Slackware Security Advisories","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/33434","name":"http://secunia.com/advisories/33434","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian update for icedove - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:205","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:205","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Advisories | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1020921","name":"http://www.securitytracker.com/id?1020921","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Mozilla Firefox 'resource:' Protocol Processing Flaw Lets Remote Users Traverse the Directory - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32196","name":"http://secunia.com/advisories/32196","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"SUSE update for MozillaFirefox, MozillaThunderbird, seamonkey, and mozilla - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32010","name":"http://secunia.com/advisories/32010","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Mozilla SeaMonkey Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45360","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45360","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11471","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11471","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html","name":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"[SECURITY] Fedora 9 Update: seamonkey-1.1.12-1.fc9","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/32042","name":"http://secunia.com/advisories/32042","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Slackware update for mozilla-firefox - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/31984","name":"http://secunia.com/advisories/31984","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Mozilla Firefox 2 Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4068","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4068","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4068","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:00:42.853Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"32025","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32025"},{"name":"32011","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32011"},{"name":"SSA:2008-269-01","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred"],"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232"},{"name":"DSA-1697","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2009/dsa-1697"},{"name":"32096","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32096"},{"name":"FEDORA-2008-8401","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html"},{"name":"USN-645-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/usn-645-1"},{"name":"MDVSA-2008:206","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:206"},{"name":"32144","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32144"},{"name":"32010","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32010"},{"name":"1020921","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1020921"},{"name":"ADV-2009-0977","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/0977"},{"name":"USN-645-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/usn-645-2"},{"name":"31346","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/31346"},{"name":"31985","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31985"},{"name":"SUSE-SA:2008:050","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html"},{"name":"31984","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31984"},{"name":"32185","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32185"},{"name":"32196","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32196"},{"name":"FEDORA-2008-8425","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html"},{"name":"DSA-1669","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2008/dsa-1669"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-44.html"},{"name":"32042","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32042"},{"name":"33433","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/33433"},{"name":"ADV-2008-2661","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2661"},{"name":"SSA:2008-269-02","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred"],"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422"},{"name":"32095","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32095"},{"name":"32089","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32089"},{"name":"256408","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1"},{"name":"32092","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32092"},{"name":"RHSA-2008:0879","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0879.html"},{"name":"MDVSA-2008:205","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:205"},{"name":"DSA-1696","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2009/dsa-1696"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://download.novell.com/Download?buildid=WZXONb-tqBw~"},{"name":"FEDORA-2008-8429","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html"},{"name":"31987","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31987"},{"name":"mozilla-resourceprotocol-info-disclosure(45360)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45360"},{"name":"USN-647-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/usn-647-1"},{"name":"32007","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32007"},{"name":"RHSA-2008:0882","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0882.html"},{"name":"32845","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32845"},{"name":"DSA-1649","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2008/dsa-1649"},{"name":"32012","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32012"},{"name":"33434","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/33434"},{"name":"SSA:2008-270-01","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred"],"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123"},{"name":"32044","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32044"},{"name":"oval:org.mitre.oval:def:11471","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11471"},{"name":"RHSA-2008:0908","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0908.html"},{"name":"34501","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/34501"},{"name":"32082","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32082"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-09-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass \"restrictions imposed on local HTML files,\" and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"32025","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32025"},{"name":"32011","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32011"},{"name":"SSA:2008-269-01","tags":["vendor-advisory","x_refsource_SLACKWARE"],"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.405232"},{"name":"DSA-1697","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2009/dsa-1697"},{"name":"32096","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32096"},{"name":"FEDORA-2008-8401","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01384.html"},{"name":"USN-645-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/usn-645-1"},{"name":"MDVSA-2008:206","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:206"},{"name":"32144","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32144"},{"name":"32010","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32010"},{"name":"1020921","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1020921"},{"name":"ADV-2009-0977","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/0977"},{"name":"USN-645-2","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/usn-645-2"},{"name":"31346","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/31346"},{"name":"31985","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31985"},{"name":"SUSE-SA:2008:050","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00005.html"},{"name":"31984","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31984"},{"name":"32185","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32185"},{"name":"32196","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32196"},{"name":"FEDORA-2008-8425","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01335.html"},{"name":"DSA-1669","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2008/dsa-1669"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.mozilla.org/security/announce/2008/mfsa2008-44.html"},{"name":"32042","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32042"},{"name":"33433","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/33433"},{"name":"ADV-2008-2661","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2661"},{"name":"SSA:2008-269-02","tags":["vendor-advisory","x_refsource_SLACKWARE"],"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.379422"},{"name":"32095","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32095"},{"name":"32089","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32089"},{"name":"256408","tags":["vendor-advisory","x_refsource_SUNALERT"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1"},{"name":"32092","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32092"},{"name":"RHSA-2008:0879","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0879.html"},{"name":"MDVSA-2008:205","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:205"},{"name":"DSA-1696","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2009/dsa-1696"},{"tags":["x_refsource_CONFIRM"],"url":"http://download.novell.com/Download?buildid=WZXONb-tqBw~"},{"name":"FEDORA-2008-8429","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01403.html"},{"name":"31987","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31987"},{"name":"mozilla-resourceprotocol-info-disclosure(45360)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45360"},{"name":"USN-647-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/usn-647-1"},{"name":"32007","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32007"},{"name":"RHSA-2008:0882","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0882.html"},{"name":"32845","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32845"},{"name":"DSA-1649","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2008/dsa-1649"},{"name":"32012","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32012"},{"name":"33434","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/33434"},{"name":"SSA:2008-270-01","tags":["vendor-advisory","x_refsource_SLACKWARE"],"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.412123"},{"name":"32044","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32044"},{"name":"oval:org.mitre.oval:def:11471","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11471"},{"name":"RHSA-2008:0908","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2008-0908.html"},{"name":"34501","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/34501"},{"name":"32082","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32082"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2008-4068","datePublished":"2008-09-24T18:00:00.000Z","dateReserved":"2008-09-12T00:00:00.000Z","dateUpdated":"2024-08-07T10:00:42.853Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-09-24 20:37:04","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-22","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:N/A:N","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.17","matchCriteriaId":"E5E06AA5-4A7C-4C61-A5B8-A73E82C470E2"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0","versionEndExcluding":"3.0.2","matchCriteriaId":"2063D1EA-2DF3-4321-AB5F-2CA620B63003"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*","versionEndExcluding":"1.1.12","matchCriteriaId":"A0C57F9A-9DD4-4F1A-A1A7-FA5325905C20"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.17","matchCriteriaId":"D2480570-397B-442B-967C-96D49D0619D2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*","matchCriteriaId":"0F92AB32-E7DE-43F4-B877-1F41FA162EC7"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*","matchCriteriaId":"5C18C3CD-969B-4AA3-AE3A-BA4A188F8BFF"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*","matchCriteriaId":"6EBDAFF8-DE44-4E80-B6BD-E341F767F501"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*","matchCriteriaId":"823BF8BE-2309-4F67-A5E2-EAD98F723468"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*","matchCriteriaId":"C91D2DBF-6DA7-4BA2-9F29-8BD2725A4701"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4068","Ordinal":"1","Title":"CVE-2008-4068","CVE":"CVE-2008-4068","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4068","Ordinal":"1","NoteData":"Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass \"restrictions imposed on local HTML files,\" and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.","Type":"Description","Title":"CVE-2008-4068"},{"CveYear":"2008","CveId":"4068","Ordinal":"2","NoteData":"2008-09-24","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4068","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}