CVE-2008-2810 — Firefox arbitrary file disclosure

Back Back to CVE browser

MEDIUM

Firefox arbitrary file disclosure

Published Jul 7, 2008

6.8

MEDIUM

CVSS 2.0

EPSS 1.10%

Description

Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly identify the context of Windows shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site for which the user has previously saved a shortcut.

Affected products

Red Hat Enterprise Linux 2.1

seamonkey-0:1.0.9-0.17.el2

Fixed · RHSA-2008:0547
Red Hat Enterprise Linux 3

seamonkey-0:1.0.9-0.20.el3

Fixed · RHSA-2008:0547
Red Hat Enterprise Linux 4

firefox-0:1.5.0.12-0.19.el4

Fixed · RHSA-2008:0549
Red Hat Enterprise Linux 4

seamonkey-0:1.0.9-16.3.el4_6

Fixed · RHSA-2008:0547
Red Hat Enterprise Linux 4

thunderbird-0:1.5.0.12-14.el4

Fixed · RHSA-2008:0616
Red Hat Enterprise Linux 5

devhelp-0:0.12-17.el5

Fixed · RHSA-2008:0569
Red Hat Enterprise Linux 5

firefox-0:3.0-2.el5

Fixed · RHSA-2008:0569
Red Hat Enterprise Linux 5

thunderbird-0:2.0.0.16-1.el5

Fixed · RHSA-2008:0616
Red Hat Enterprise Linux 5

xulrunner-0:1.9-1.el5

Fixed · RHSA-2008:0569
Red Hat Enterprise Linux 5

yelp-0:2.16.0-19.el5

Fixed · RHSA-2008:0569

Product	Package	State	Advisory
Red Hat Enterprise Linux 2.1	seamonkey-0:1.0.9-0.17.el2	Fixed	RHSA-2008:0547
Red Hat Enterprise Linux 3	seamonkey-0:1.0.9-0.20.el3	Fixed	RHSA-2008:0547
Red Hat Enterprise Linux 4	firefox-0:1.5.0.12-0.19.el4	Fixed	RHSA-2008:0549
Red Hat Enterprise Linux 4	seamonkey-0:1.0.9-16.3.el4_6	Fixed	RHSA-2008:0547
Red Hat Enterprise Linux 4	thunderbird-0:1.5.0.12-14.el4	Fixed	RHSA-2008:0616
Red Hat Enterprise Linux 5	devhelp-0:0.12-17.el5	Fixed	RHSA-2008:0569
Red Hat Enterprise Linux 5	firefox-0:3.0-2.el5	Fixed	RHSA-2008:0569
Red Hat Enterprise Linux 5	thunderbird-0:2.0.0.16-1.el5	Fixed	RHSA-2008:0616
Red Hat Enterprise Linux 5	xulrunner-0:1.9-1.el5	Fixed	RHSA-2008:0569
Red Hat Enterprise Linux 5	yelp-0:2.16.0-19.el5	Fixed	RHSA-2008:0569

Remediation

No remediation recorded yet.

Metrics

1.10% 0.01101

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.01101

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	1.10% (0.01101)	64.49th	v5 (v2026.06.15)
Jun 15, 2026	1.10% (0.01101)	61.26th	v5 (v2026.06.15)
Mar 17, 2025	0.93% (0.00933)	74.54th	v4 (v2025.03.14)
Dec 12, 2024	2.20% (0.02202)	89.84th	v3 (v2023.03.01)
Jul 13, 2024	1.51% (0.01506)	87.09th	v3 (v2023.03.01)
May 4, 2024	1.39% (0.01393)	86.30th	v3 (v2023.03.01)
Mar 7, 2023	1.39% (0.01393)	84.30th	v3 (v2023.03.01)
Mar 6, 2023	3.93% (0.03932)	85.88th	v2 (v2022.01.01)
Apr 1, 2022	3.93% (0.03932)	84.43th	v2 (v2022.01.01)
Feb 4, 2022	3.93% (0.03932)	67.70th	v2 (v2022.01.01)

Weaknesses (1)

CWE-264

References (40)

http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html
vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2008-0616.html
vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/30878
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/30898
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/30903
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/30911
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://secunia.com/advisories/30949
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31005
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31008
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31021
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31023
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31076
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31195
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31377
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33433
third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-200808-03.xml
vendor-advisoryx_refsource_GENTOO
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152
vendor-advisoryx_refsource_SLACKWARE
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911
vendor-advisoryx_refsource_SLACKWARE
http://wiki.rpath.com/Advisories:rPSA-2008-0216
x_refsource_CONFIRM
http://www.debian.org/security/2009/dsa-1697
vendor-advisoryx_refsource_DEBIAN
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15
x_refsource_CONFIRM
http://www.mozilla.org/security/announce/2008/mfsa2008-32.html
x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2008-0547.html
vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2008-0549.html
vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2008-0569.html
vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/archive/1/494080/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/30038
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1020419
vdb-entryx_refsource_SECTRACK
http://www.ubuntu.com/usn/usn-619-1
vendor-advisoryx_refsource_UBUNTU
http://www.vupen.com/english/advisories/2008/1993/references
vdb-entryx_refsource_VUPEN
https://access.redhat.com/security/cve/CVE-2008-2810
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=410156
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=452712
Issue Tracking
https://issues.rpath.com/browse/RPL-2646
x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2008-2810
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9593
vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2008-2810
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.html
vendor-advisoryx_refsource_FEDORA
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.html
vendor-advisoryx_refsource_FEDORA
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.html
vendor-advisoryx_refsource_FEDORA

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html		vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2008-0616.html		vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/30878		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/30898		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/30903		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/30911		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://secunia.com/advisories/30949		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31005		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31008		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31021		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31023		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31076		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31195		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/31377		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33433		third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-200808-03.xml		vendor-advisoryx_refsource_GENTOO
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152		vendor-advisoryx_refsource_SLACKWARE
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911		vendor-advisoryx_refsource_SLACKWARE
http://wiki.rpath.com/Advisories:rPSA-2008-0216		x_refsource_CONFIRM
http://www.debian.org/security/2009/dsa-1697		vendor-advisoryx_refsource_DEBIAN
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15		x_refsource_CONFIRM
http://www.mozilla.org/security/announce/2008/mfsa2008-32.html		x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2008-0547.html		vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2008-0549.html		vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2008-0569.html		vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/archive/1/494080/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/30038		vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1020419		vdb-entryx_refsource_SECTRACK
http://www.ubuntu.com/usn/usn-619-1		vendor-advisoryx_refsource_UBUNTU
http://www.vupen.com/english/advisories/2008/1993/references		vdb-entryx_refsource_VUPEN
https://access.redhat.com/security/cve/CVE-2008-2810		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=410156		x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=452712		Issue Tracking
https://issues.rpath.com/browse/RPL-2646		x_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2008-2810
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9593		vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2008-2810
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.html		vendor-advisoryx_refsource_FEDORA
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.html		vendor-advisoryx_refsource_FEDORA
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.html		vendor-advisoryx_refsource_FEDORA

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published Jul 7, 2008

Updated Aug 7, 2024

Reserved Jun 20, 2008

Link CVE-2008-2810

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2008-2810

Red Hat

Severity Moderate

Public date Jul 2, 2008

Links CVE-2008-2810 - Bugzilla