CVE-2008-0017
HighSummary
Parser typu MIME http-index-format (nsDirIndexParser) w przeglądarkach Firefox 3.x przed wersją 3.0.4, Firefox 2.x przed wersją 2.0.0.18 oraz SeaMonkey 1.x przed wersją 1.1.13 nie sprawdza błędów alokacji pamięci. To umożliwia zdalnym atakującym spowodowanie awarii (denial of service) oraz potencjalne wykonanie dowolnego kodu poprzez odpowiedź HTTP z odpowiednio skonstruowanym nagłówkiem 200, co prowadzi do uszkodzenia pamięci i przepełnienia bufora.
Risk Assessment
Organizacje mogą być narażone na ataki, które prowadzą do awarii systemów oraz potencjalnego przejęcia kontroli nad nimi. Wykorzystanie tej podatności może skutkować poważnymi konsekwencjami dla bezpieczeństwa danych.
Recommendation
Zaleca się aktualizację przeglądarek Firefox i SeaMonkey do najnowszych wersji, które zawierają poprawki eliminujące tę podatność. Dodatkowo, warto monitorować ruch HTTP w celu wykrywania podejrzanych odpowiedzi.
Related vulnerabilities
- CVE-2026-8778Critical
The MIPL Grouped Checkout Fields for WooCommerce plugin for WordPress (versions up to and including 1.2.1) is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function. This allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution.
- CVE-2026-82107Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authentication flaw that allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions.
- CVE-2026-82100Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal issue that allows a remote authenticated attacker to cause a denial of service.
- CVE-2026-81204Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary code due to code injection during graph construction.
- CVE-2026-80424Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
- CVE-2026-79724Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-78573Critical
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 allow a remote attacker to gain administrative access due to the use of default credentials.
- CVE-2026-45764Critical
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion, causing Suricata to crash and resulting in denial of service.
- CVE-2026-19646Critical
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.
- CVE-2026-89094Critical
Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
Original NVD description (English source)
The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP index response with a crafted 200 header, which triggers memory corruption and a buffer overflow.