CVE-2008-3836

Upstream information

CVE-2008-3836 at MITRE

Description

feedWriter in Mozilla Firefox before 2.0.0.17 allows remote attackers to execute scripts with chrome privileges via vectors related to feed preview and the (1) elem.doCommand, (2) elem.dispatchEvent, (3) _setTitleText, (4) _setTitleImage, and (5) _initSubscriptionUI functions.

---

SUSE information

Overall state of this security issue: Ignore

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

SUSE Bugzilla entry: 429179 [RESOLVED / FIXED]

SUSE Security Advisories:

• SUSE-SA:2008:050, published Wed, 08 Oct 2008 16:00:00 +0000

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Server 11 SP1	MozillaFirefox >= 3.5.9-0.1.1 MozillaFirefox-translations >= 3.5.9-0.1.1 mozilla-xulrunner190 >= 1.9.0.19-0.1.1 mozilla-xulrunner190-32bit >= 1.9.0.19-0.1.1 mozilla-xulrunner190-gnomevfs >= 1.9.0.19-0.1.1 mozilla-xulrunner190-translations >= 1.9.0.19-0.1.1 mozilla-xulrunner190-x86 >= 1.9.0.19-0.1.1	Patchnames: SUSE Linux Enterprise Server 11 SP1 GA MozillaFirefox SUSE Linux Enterprise Server 11 SP1 GA mozilla-xulrunner190
SUSE Linux Enterprise Server 11 SP2	MozillaFirefox >= 10.0-0.3.2 MozillaFirefox-translations >= 10.0-0.3.2	Patchnames: SUSE Linux Enterprise Server 11 SP2 GA MozillaFirefox
SUSE Linux Enterprise Server 11 SP3	MozillaFirefox >= 17.0.4esr-0.10.42 MozillaFirefox-translations >= 17.0.4esr-0.10.42	Patchnames: SUSE Linux Enterprise Server 11 SP3 GA MozillaFirefox
SUSE Linux Enterprise Server 11 SP4	MozillaFirefox >= 31.7.0esr-0.8.1 MozillaFirefox-translations >= 31.7.0esr-0.8.1	Patchnames: SUSE Linux Enterprise Server 11 SP4 GA MozillaFirefox
SUSE Linux Enterprise Software Development Kit 11 SP4	MozillaFirefox-devel >= 31.7.0esr-0.8.1	Patchnames: SUSE Linux Enterprise Software Development Kit 11 SP4 GA MozillaFirefox-devel
SUSE Linux Enterprise SDK 10 SP2	gecko-sdk >= 1.8.0.14eol-0.7	sled10-sp2.x86 sle10-sp1-sdk.x86 sles10.x86 sle10-sp2-sdk.x86 sles10.ppc sle10-sp1-sdk.s390x sled10.x86 sled10-sp2.x86-64 sle10-sp1-sdk.ppc sles10-sp2.ia64 sles10-sp2.ppc sles10.ia64 sles10-sp2.s390x sle10-sp1-sdk.x86-64 sle10-sp2-sdk.ia64 sle10-sp2-sdk.x86-64 sles10-sp2.x86-64 sles10.x86-64 sled10.x86-64 sles10-sp2.x86 sles10.s390x sle10-sp1-sdk.ia64 sle10-sp2-sdk.s390x sle10-sp2-sdk.ppc ZYPP Patch Nr: 5654
openSUSE 11.0	mozilla-xulrunner181-debuginfo >= 1.8.1.13-22.1 mozilla-xulrunner181-debugsource >= 1.8.1.13-22.1
openSUSE 11.0	mozilla-xulrunner181 >= 1.8.1.13-22.1 mozilla-xulrunner181-32bit >= 1.8.1.13-22.1 mozilla-xulrunner181-64bit >= 1.8.1.13-22.1 mozilla-xulrunner181-devel >= 1.8.1.13-22.1 mozilla-xulrunner181-l10n >= 1.8.1.13-22.1
Novell Linux Desktop 9 for x86	epiphany >= 1.2.10-0.7 epiphany-doc >= 1.2.10-0.7 epiphany-extensions >= 0.8.2-2.8 epiphany-extensions-devel >= 0.8.2-2.8 mozilla >= 1.8_seamonkey_1.0.9-1.15 mozilla-cs >= 1.8_seamonkey_1.0.4-0.11 mozilla-deat >= 1.8_seamonkey_1.0.4-0.11 mozilla-devel >= 1.8_seamonkey_1.0.9-1.15 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.15 mozilla-hu >= 1.80_seamonkey_1.0.4-9 mozilla-irc >= 1.8_seamonkey_1.0.9-1.15 mozilla-mail >= 1.8_seamonkey_1.0.9-1.15 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.15	sles9-nld.x86 sles9-nld.x86-64 sles9-nlpos.x86 core9.ppc core9.x86-64 core9.ia64 core9.s390 core9.s390x sles9-oes.x86 core9.x86 YOU Patch Nr: 12264
Novell Linux Desktop 9 for x86_64	epiphany >= 1.2.10-0.7 epiphany-doc >= 1.2.10-0.7 epiphany-extensions >= 0.8.2-2.8 epiphany-extensions-devel >= 0.8.2-2.8 mozilla >= 1.8_seamonkey_1.0.9-1.15 mozilla-cs >= 1.8_seamonkey_1.0.4-0.11 mozilla-deat >= 1.8_seamonkey_1.0.4-0.11 mozilla-devel >= 1.8_seamonkey_1.0.9-1.15 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.15 mozilla-hu >= 1.80_seamonkey_1.0.4-9 mozilla-irc >= 1.8_seamonkey_1.0.9-1.15 mozilla-lib64 >= 1.8_seamonkey_1.0.9-0.6 mozilla-mail >= 1.8_seamonkey_1.0.9-1.15 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.15	sles9-nld.x86 sles9-nld.x86-64 sles9-nlpos.x86 core9.ppc core9.x86-64 core9.ia64 core9.s390 core9.s390x sles9-oes.x86 core9.x86 YOU Patch Nr: 12264
Open Enterprise Server	mozilla >= 1.8_seamonkey_1.0.9-1.15 mozilla-calendar >= 1.8_seamonkey_1.0.9-1.15 mozilla-cs >= 1.8_seamonkey_1.0.4-0.11 mozilla-deat >= 1.8_seamonkey_1.0.4-0.11 mozilla-devel >= 1.8_seamonkey_1.0.9-1.15 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.15 mozilla-hu >= 1.80_seamonkey_1.0.4-9 mozilla-irc >= 1.8_seamonkey_1.0.9-1.15 mozilla-mail >= 1.8_seamonkey_1.0.9-1.15 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.15	sles9-nld.x86 sles9-nld.x86-64 sles9-nlpos.x86 core9.ppc core9.x86-64 core9.ia64 core9.s390 core9.s390x sles9-oes.x86 core9.x86 YOU Patch Nr: 12264
Novell Linux Desktop 9 for x86 Novell Linux Desktop 9 for x86_64	MozillaFirefox >= 1.5.0.12-0.13 MozillaFirefox-translations >= 1.5.0.12-0.13	sles9-nld.x86-64 sles9-nld.x86 YOU Patch Nr: 12263