Fluid Attacks Database

Description

Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	devhelp	<0:0.12-19.el5	0:0.12-19.el5
rpm rhel5	nss	<0:3.12.1.1-1.el5	0:3.12.1.1-1.el5
rpm rhel5	firefox	<0:3.0.2-3.el5	0:3.0.2-3.el5
rpm rhel5	xulrunner	<0:1.9.0.2-5.el5	0:1.9.0.2-5.el5
rpm rhel5	yelp	<0:2.16.0-21.el5	0:2.16.0-21.el5

Aliases

1. CVE-2008-38372. NVD-2008-38373. OSV-2008-3837

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.