CVE-2008-0418

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-02-08 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8, when using "flat" addons, allows remote attackers to read arbitrary Javascript, image, and stylesheet files via the chrome: URI scheme, as demonstrated by stealing session information from sessionstore.js.

Affected products

Mozilla Firefox: through 2.0.0.11
Mozilla Seamonkey: through 1.1.7
Mozilla Thunderbird: through 2.0.0.11

References

http://browser.netscape.com/releasenotes/
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00006.html
http://secunia.com/advisories/28622/
http://secunia.com/advisories/28754
http://secunia.com/advisories/28766
http://secunia.com/advisories/28808
http://secunia.com/advisories/28815
http://secunia.com/advisories/28818
http://secunia.com/advisories/28839
http://secunia.com/advisories/28864
http://secunia.com/advisories/28865
http://secunia.com/advisories/28877

Get alerted when CVE-2008-0418 or the next vulnerability affects your stack