CVE-2008-5021 Use after free in n/a
Remote attackers can cause a crash or execute arbitrary code by manipulating file input elements during initialization in Firefox, Thunderbird, and SeaMonkey.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-5021?
CVE-2008-5021 is a critical use after free vulnerability in Canonical Ubuntu Linux, published on 13 Nov 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.
Weakness: CWE-362
Which versions are affected by CVE-2008-5021?
It affects 13 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird and 7 more.
How do I fix CVE-2008-5021?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2008-5021 being exploited?
There is no known exploitation of CVE-2008-5021 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as GHSA-7qf3-8pfp-6qg9.