CVE-2008-5913

Severity: medium (CVSS 4.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-20 · updated 2026-06-16

Description

The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."

Affected products

Mozilla Firefox: 3.5, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.5.5 (+8)
Mozilla Seamonkey: through 2.0.4; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+37)

References

http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html
http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
http://secunia.com/advisories/40326
http://secunia.com/advisories/40401
http://secunia.com/advisories/40481
http://support.avaya.com/css/P8/documents/100091069
http://ubuntu.com/usn/usn-930-1
http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161
http://www.infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:125

Get alerted when CVE-2008-5913 or the next vulnerability affects your stack