CVE-2008-5510

NameCVE-2008-5510
DescriptionThe CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to bypass protection mechanisms such as sanitization routines.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1707-1
NVD severitymedium

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceapesourceetch(unfixed)end-of-life
iceapesource(unstable)1.1.14-1
icedovesource(unstable)2.0.0.19-1
iceweaselsourceetch2.0.0.19-0etch1DSA-1707-1
iceweaselsource(unstable)3.0.5-1
xulrunnersourceetch(unfixed)end-of-life
xulrunnersource(unstable)1.9.0.5-1

Notes

[etch] - iceape <end-of-life> (Etch Packages no longer covered by security support)
[etch] - xulrunner <end-of-life> (Etch Packages no longer covered by security support)
patch will be checked for icedove/iceape/xulrunner by Alexander for next round

Search for package or bug name: Reporting problems