Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2008-5508: Firefox, Thunderbird, SeaMonkey can hide real web addresses

CVE-2008-5508 · published 17 years ago

Summary

Older versions of Firefox, Thunderbird and SeaMonkey may treat spaces or hidden characters at the start of a web address as normal, letting attackers display a fake link that looks safe. This can make phishing emails or sites appear trustworthy. Upgrade to the latest versions of these programs to ensure URLs are shown correctly.

What to do

Update mozilla seamonkey to version 1.1.14 or later.
Update mozilla thunderbird to version 2.0.0.19 or later.

Affected software

Vendor	Product	Affected versions
mozilla	firefox	>= 2.0, < 2.0.0.19 >= 3.0, < 3.0.5 `cpe:2.3:a:mozilla:firefox::::::::`
mozilla	seamonkey	>= 1.0, < 1.1.14 `cpe:2.3:a:mozilla:seamonkey::::::::`
mozilla	thunderbird	>= 2.0, < 2.0.0.19 `cpe:2.3:a:mozilla:thunderbird::::::::`
canonical	ubuntu_linux	6.06 7.10 8.04 8.10 `cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::`
debian	debian_linux	4.0 5.0 `cpe:2.3:o:debian:debian_linux:4.0:::::::*`

Original advisory text

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters...

References

http://secunia.com/advisories/33184 Third Party Advisory
http://secunia.com/advisories/33188 Third Party Advisory
http://secunia.com/advisories/33189 Third Party Advisory
http://secunia.com/advisories/33203 Third Party Advisory
http://secunia.com/advisories/33204 Third Party Advisory
http://secunia.com/advisories/33205 Third Party Advisory
http://secunia.com/advisories/33216 Third Party Advisory
http://secunia.com/advisories/33231 Third Party Advisory
http://secunia.com/advisories/33408 Third Party Advisory
http://secunia.com/advisories/33415 Third Party Advisory
http://secunia.com/advisories/33421 Third Party Advisory
http://secunia.com/advisories/33433 Third Party Advisory
http://secunia.com/advisories/33434 Third Party Advisory
http://secunia.com/advisories/33523 Third Party Advisory
http://secunia.com/advisories/33547 Third Party Advisory
http://secunia.com/advisories/34501 Third Party Advisory
http://secunia.com/advisories/35080 Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1 Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1 Broken Link
http://www.debian.org/security/2009/dsa-1696 Third Party Advisory
http://www.debian.org/security/2009/dsa-1697 Third Party Advisory
http://www.debian.org/security/2009/dsa-1704 Third Party Advisory
http://www.debian.org/security/2009/dsa-1707 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:244 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:245 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:012 Third Party Advisory
http://www.mozilla.org/security/announce/2008/mfsa2008-66.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2008-1036.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-1037.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-0002.html Third Party Advisory
http://www.securityfocus.com/bid/32882 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021426 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/usn-690-2 Third Party Advisory
http://www.ubuntu.com/usn/usn-701-1 Third Party Advisory
http://www.ubuntu.com/usn/usn-701-2 Third Party Advisory
http://www.vupen.com/english/advisories/2009/0977 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=425046 Issue Tracking Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=460803 Issue Tracking Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/47414 Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Third Party Advisory
https://usn.ubuntu.com/690-1/ Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published17 Dec 2008

Updated29 Oct 2026

First seen29 Sep 2026

Sources

CVE-2008-5508 · NVD

Track software like this

Free during beta