CVE catalog
CVE-2008-5506
xulrunner - several vulnerabilities
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.09% · Oct 25, 2026
Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHttpRequest to an attacker-controlled resource that uses a 302 redirect to a resource in a different domain, then reading content from the response, aka "response disclosure."
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | xulrunner | 4.0 | 1.8.0.11-2 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.11-3 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.11-4 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.11-4.1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.12-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch2 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch3 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch3+lenny1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.14~pre071019b-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.14~pre071019b-0lenny1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.14~pre071019c-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.15~pre080131a-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.15~pre080131b-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.15~pre080323b-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.15~pre080323b-0etch2 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.15~pre080614d-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.15~pre080614h-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.15~pre080614i-0etch1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | xulrunner | deb | 4.0 | 1.8.0.15~pre080614i-0etch1 | Not reported | DSA-1704-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: