CVE-2008-1240

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.

🔗 References (52)

• secalert@redhathttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
• secalert@redhathttp://secunia.com/advisories/29526
• secalert@redhathttp://secunia.com/advisories/29539
• secalert@redhathttp://secunia.com/advisories/29541
• secalert@redhathttp://secunia.com/advisories/29547
• secalert@redhathttp://secunia.com/advisories/29558
• secalert@redhathttp://secunia.com/advisories/29560
• secalert@redhathttp://secunia.com/advisories/29616
• secalert@redhathttp://secunia.com/advisories/29645
• secalert@redhathttp://secunia.com/advisories/30327
• secalert@redhathttp://secunia.com/advisories/30620
• secalert@redhathttp://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1
• secalert@redhathttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
• secalert@redhathttp://www.debian.org/security/2008/dsa-1532
• secalert@redhathttp://www.debian.org/security/2008/dsa-1534