Login Request a demo
Unscored severity · published Aug 13, 2009
CVE-2008-6961
mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the…
–
CVSS
1.5%
EPSS
No
On KEV
Description
mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the recipient, or comments in forwarded mail, via script that reads the (1) .documentURI or (2) .textContent DOM properties.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Seamonkey · Mozilla
through 1.1.12; 1.0; 1.0; 1.0; 1.0; 1.0; +14 more · source: NVD
TH
Thunderbird · Mozilla
through 2.0.0.17; 0.1; 0.2; 0.3; 0.4; 0.5; +34 more · source: NVD
Affected product
SE
Seamonkey
Mozilla
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6961
Vendor Advisory
http://secunia.com/advisories/32714
Vendor Advisory
http://secunia.com/advisories/32715
Vendor Advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-59.html
www.securityfocus.com
http://www.securityfocus.com/bid/32363
www.securitytracker.com
http://www.securitytracker.com/id?1021247
bugzilla.mozilla.org
https://bugzilla.mozilla.org/show_bug.cgi?id=458883
More from Seamonkey
9.8
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2014-1532
Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird…
9.8
CVE-2014-1524
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not…
9.8
CVE-2014-1514
vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the…
9.8
CVE-2014-1511
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified…