CVE-2008-3837 Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or uns...
HighCVSS 9.3
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | < 2.0.0.17 | 2.0.0.17 |
| mozilla Firefox | >= 3.0, < 3.0.2 | 3.0.2 |
| mozilla seamonkey | < 1.1.12 | 1.1.12 |
| debian linux | = 4.0 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
References
- download.novell.com third-party-advisory
- SUSE-SA:2008:050 third-party-advisory vendor-advisory
- 31984 third-party-advisory
- 31985 third-party-advisory
- 31987 third-party-advisory
- 32010 third-party-advisory
- 32011 third-party-advisory
- 32012 third-party-advisory
- 32042 third-party-advisory
- 32044 third-party-advisory
- 32089 third-party-advisory
- 32095 third-party-advisory
- 32096 third-party-advisory
- 32144 third-party-advisory
- 32185 third-party-advisory
- 32196 third-party-advisory
- 32845 third-party-advisory
- 33433 third-party-advisory
- 34501 third-party-advisory
- SSA:2008-269-02 third-party-advisory vendor-advisory
- SSA:2008-269-01 third-party-advisory vendor-advisory
- 256408 broken-link vendor-advisory
- DSA-1649 third-party-advisory vendor-advisory
- DSA-1669 third-party-advisory vendor-advisory
- DSA-1697 third-party-advisory vendor-advisory
- MDVSA-2008:205 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- RHSA-2008:0879 third-party-advisory vendor-advisory
- RHSA-2008:0882 third-party-advisory vendor-advisory
- 31346 third-party-advisory vdb-entry
- 1020922 third-party-advisory vdb-entry
- USN-645-1 third-party-advisory vendor-advisory
- USN-645-2 third-party-advisory vendor-advisory
- ADV-2008-2661 third-party-advisory vdb-entry
- ADV-2009-0977 third-party-advisory vdb-entry
- bugzilla.mozilla.org issue-tracking patch vendor-advisory
- firefox-draganddrop-weak-security(45348) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:9950 signature third-party-advisory vdb-entry
- FEDORA-2008-8425 third-party-advisory vendor-advisory
- FEDORA-2008-8401 third-party-advisory vendor-advisory
- FEDORA-2008-8429 third-party-advisory vendor-advisory