CVE catalog

CVE-2008-5508

xulrunner - several vulnerabilities

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.22% · Oct 27, 2026

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxulrunner4.01.8.0.11-2vulnerable
Debianxulrunner4.01.8.0.11-3vulnerable
Debianxulrunner4.01.8.0.11-4vulnerable
Debianxulrunner4.01.8.0.11-4.1vulnerable
Debianxulrunner4.01.8.0.12-0etch1vulnerable
Debianxulrunner4.01.8.0.13~pre070720-0etch1vulnerable
Debianxulrunner4.01.8.0.13~pre070720-0etch2vulnerable
Debianxulrunner4.01.8.0.13~pre070720-0etch3vulnerable
Debianxulrunner4.01.8.0.13~pre070720-0etch3+lenny1vulnerable
Debianxulrunner4.01.8.0.14~pre071019b-0etch1vulnerable
Debianxulrunner4.01.8.0.14~pre071019b-0lenny1vulnerable
Debianxulrunner4.01.8.0.14~pre071019c-0etch1vulnerable
Debianxulrunner4.01.8.0.15~pre080131a-0etch1vulnerable
Debianxulrunner4.01.8.0.15~pre080131b-0etch1vulnerable
Debianxulrunner4.01.8.0.15~pre080323b-0etch1vulnerable
Debianxulrunner4.01.8.0.15~pre080323b-0etch2vulnerable
Debianxulrunner4.01.8.0.15~pre080614d-0etch1vulnerable
Debianxulrunner4.01.8.0.15~pre080614h-0etch1vulnerable
Debianxulrunner4.01.8.0.15~pre080614i-0etch1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxulrunnerdeb4.01.8.0.15~pre080614i-0etch1Not reportedDSA-1704-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]