CVE-2008-2801

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-07-07 · updated 2026-06-16
Weakness: CWE-287

Description

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly implement JAR signing, which allows remote attackers to execute arbitrary code via (1) injection of JavaScript into documents within a JAR archive or (2) a JAR archive that uses relative URLs to JavaScript files.

Affected products

Mozilla Firefox: through 2.0.0.14; 2.0, 2.0.0.1, 2.0.0.2, 2.0.0.3, 2.0.0.4, 2.0.0.5 (+8)
Mozilla Seamonkey: through 1.1.9; 1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6 (+2)

References

http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html
http://rhn.redhat.com/errata/RHSA-2008-0616.html
http://secunia.com/advisories/30878
http://secunia.com/advisories/30898
http://secunia.com/advisories/30903
http://secunia.com/advisories/30911
http://secunia.com/advisories/30949
http://secunia.com/advisories/31005
http://secunia.com/advisories/31008
http://secunia.com/advisories/31021
http://secunia.com/advisories/31023
http://secunia.com/advisories/31069

Get alerted when CVE-2008-2801 or the next vulnerability affects your stack