CVE-2008-5021

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-11-13 · updated 2026-06-16
Weakness: CWE-362

Description

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by modifying properties of a file input element while it is still being initialized, then using the blur method to access uninitialized memory.

Affected products

Canonical Ubuntu Linux: 6.06, 7.10, 8.04, 8.10
Debian Linux: 4.0
Fedoraproject Fedora: 8, 9
Mozilla Firefox: from 2.0 before 2.0.0.18; from 3.0 before 3.0.4 — fixed in 2.0.0.18, 3.0.4
Mozilla Seamonkey: from 1.0 before 1.1.13 — fixed in 1.1.13
Mozilla Thunderbird: from 2.0 before 2.0.0.18 — fixed in 2.0.0.18
Novell Linux Desktop: 9
Micro Focus International Open Enterprise Server: all versions
Opensuse: 10.2, 10.3, 11.0
SUSE Linux Enterprise Debuginfo: 10-sp2
SUSE Linux Enterprise Server 15 SP1: 10
SUSE Linux Enterprise Server: 9, 10-sp1
SUSE Linux Enterprise Software Development Kit: 10-sp1, 10-sp2

How to fix

Upgrade to a fixed version: Mozilla Firefox 2.0.0.18, 3.0.4; Mozilla Seamonkey 1.1.13; Mozilla Thunderbird 2.0.0.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2008-5021 or the next vulnerability affects your stack