CVE-2008-3836

Upstream information

CVE-2008-3836 at MITRE

Description

feedWriter in Mozilla Firefox before 2.0.0.17 allows remote attackers to execute scripts with chrome privileges via vectors related to feed preview and the (1) elem.doCommand, (2) elem.dispatchEvent, (3) _setTitleText, (4) _setTitleImage, and (5) _initSubscriptionUI functions.

---

SUSE information

Overall state of this security issue: Ignore

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Low
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

SUSE Bugzilla entry: 429179 [RESOLVED / FIXED]

SUSE Security Advisories:

• SUSE-SA:2008:050, published Wed, 08 Oct 2008 16:00:00 +0000

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Server 11 SP1	MozillaFirefox >= 3.5.9-0.1.1 MozillaFirefox-translations >= 3.5.9-0.1.1 mozilla-xulrunner190 >= 1.9.0.19-0.1.1 mozilla-xulrunner190-32bit >= 1.9.0.19-0.1.1 mozilla-xulrunner190-gnomevfs >= 1.9.0.19-0.1.1 mozilla-xulrunner190-translations >= 1.9.0.19-0.1.1 mozilla-xulrunner190-x86 >= 1.9.0.19-0.1.1
SUSE Linux Enterprise Server 11 SP2	MozillaFirefox >= 10.0-0.3.2 MozillaFirefox-translations >= 10.0-0.3.2
SUSE Linux Enterprise Server 11 SP3	MozillaFirefox >= 17.0.4esr-0.10.42 MozillaFirefox-translations >= 17.0.4esr-0.10.42
SUSE Linux Enterprise Server 11 SP4	MozillaFirefox >= 31.7.0esr-0.8.1 MozillaFirefox-translations >= 31.7.0esr-0.8.1
SUSE Linux Enterprise Software Development Kit 11 SP4	MozillaFirefox-devel >= 31.7.0esr-0.8.1
SUSE Linux Enterprise SDK 10 SP2	gecko-sdk >= 1.8.0.14eol-0.7	Builds ZYPP Patch Nr: 5654
openSUSE 11.0	mozilla-xulrunner181-debuginfo >= 1.8.1.13-22.1 mozilla-xulrunner181-debugsource >= 1.8.1.13-22.1
openSUSE 11.0	mozilla-xulrunner181 >= 1.8.1.13-22.1 mozilla-xulrunner181-32bit >= 1.8.1.13-22.1 mozilla-xulrunner181-64bit >= 1.8.1.13-22.1 mozilla-xulrunner181-devel >= 1.8.1.13-22.1 mozilla-xulrunner181-l10n >= 1.8.1.13-22.1
Novell Linux Desktop 9 for x86	epiphany >= 1.2.10-0.7 epiphany-doc >= 1.2.10-0.7 epiphany-extensions >= 0.8.2-2.8 epiphany-extensions-devel >= 0.8.2-2.8 mozilla >= 1.8_seamonkey_1.0.9-1.15 mozilla-cs >= 1.8_seamonkey_1.0.4-0.11 mozilla-deat >= 1.8_seamonkey_1.0.4-0.11 mozilla-devel >= 1.8_seamonkey_1.0.9-1.15 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.15 mozilla-hu >= 1.80_seamonkey_1.0.4-9 mozilla-irc >= 1.8_seamonkey_1.0.9-1.15 mozilla-mail >= 1.8_seamonkey_1.0.9-1.15 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.15	Builds YOU Patch Nr: 12264
Novell Linux Desktop 9 for x86_64	epiphany >= 1.2.10-0.7 epiphany-doc >= 1.2.10-0.7 epiphany-extensions >= 0.8.2-2.8 epiphany-extensions-devel >= 0.8.2-2.8 mozilla >= 1.8_seamonkey_1.0.9-1.15 mozilla-cs >= 1.8_seamonkey_1.0.4-0.11 mozilla-deat >= 1.8_seamonkey_1.0.4-0.11 mozilla-devel >= 1.8_seamonkey_1.0.9-1.15 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.15 mozilla-hu >= 1.80_seamonkey_1.0.4-9 mozilla-irc >= 1.8_seamonkey_1.0.9-1.15 mozilla-lib64 >= 1.8_seamonkey_1.0.9-0.6 mozilla-mail >= 1.8_seamonkey_1.0.9-1.15 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.15	Builds YOU Patch Nr: 12264
Open Enterprise Server	mozilla >= 1.8_seamonkey_1.0.9-1.15 mozilla-calendar >= 1.8_seamonkey_1.0.9-1.15 mozilla-cs >= 1.8_seamonkey_1.0.4-0.11 mozilla-deat >= 1.8_seamonkey_1.0.4-0.11 mozilla-devel >= 1.8_seamonkey_1.0.9-1.15 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.15 mozilla-hu >= 1.80_seamonkey_1.0.4-9 mozilla-irc >= 1.8_seamonkey_1.0.9-1.15 mozilla-mail >= 1.8_seamonkey_1.0.9-1.15 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.15	Builds YOU Patch Nr: 12264
Novell Linux Desktop 9 for x86 Novell Linux Desktop 9 for x86_64	MozillaFirefox >= 1.5.0.12-0.13 MozillaFirefox-translations >= 1.5.0.12-0.13	Builds YOU Patch Nr: 12263