CVE-2008-1240
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse...
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.
Exploit likelihood
What each source reports
NVD Score used
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.
- Record
CVE-2008-1240- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.
- Record
CVE-2008-1240- Updated
- 2026-11-02
EUVDEUVD-2008-1248 No score
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.
- Record
EUVD-2008-1248- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mpj-g6c5-r6j3 No score
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse...
LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.
- Record
GHSA-8mpj-g6c5-r6j3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xulrunnerDebian:4.0 From an advisory covering 9 CVEs |
before 1.8.0.15~pre080323b-0etch1, plus listed versions 1.8.0.11-21.8.0.11-31.8.0.11-41.8.0.11-4.11.8.0.12-0etch1 Show 9 moreShow less1.8.0.13~pre070720-0etch11.8.0.13~pre070720-0etch21.8.0.13~pre070720-0etch31.8.0.13~pre070720-0etch3+lenny11.8.0.14~pre071019b-0etch11.8.0.14~pre071019b-0lenny11.8.0.14~pre071019c-0etch11.8.0.15~pre080131a-0etch11.8.0.15~pre080131b-0etch1 |
1.8.0.15~pre080323b-0etch1 |
iceapeDebian:4.0 From an advisory covering 11 CVEs |
before 1.0.13~pre080323b-0etch1, plus listed versions 1.0.10~pre070720-0etch11.0.10~pre070720-0etch1+lenny11.0.10~pre070720-0etch31.0.10~pre070720-0etch3+lenny11.0.11~pre071022-0etch1 Show 5 moreShow less1.0.11~pre071022-0etch1+lenny11.0.12~pre080131b-0etch11.0.12~pre080131b-0etch21.0.8-41.0.9-0etch1 |
1.0.13~pre080323b-0etch1 |
iceapeDebian:4.0 From an advisory covering 11 CVEs |
before 1.0.13~pre080323b-0etch2, plus listed versions 1.0.10~pre070720-0etch11.0.10~pre070720-0etch1+lenny11.0.10~pre070720-0etch31.0.10~pre070720-0etch3+lenny11.0.11~pre071022-0etch1 Show 6 moreShow less1.0.11~pre071022-0etch1+lenny11.0.12~pre080131b-0etch11.0.12~pre080131b-0etch21.0.13~pre080323b-0etch11.0.8-41.0.9-0etch1 |
1.0.13~pre080323b-0etch2 |
iceweaselDebian:4.0 From an advisory covering 9 CVEs |
before 2.0.0.13-0etch1, plus listed versions 2.0.0.10-0etch12.0.0.10-12.0.0.10-22.0.0.11-12.0.0.12-0etch1 Show 19 moreShow less2.0.0.12-12.0.0.12-22.0.0.3-12.0.0.3-22.0.0.4-0etch12.0.0.4-12.0.0.5-0etch12.0.0.5-0etch1+lenny12.0.0.5-12.0.0.5-22.0.0.6+2.0.0.8-0etch12.0.0.6-0etch12.0.0.6-0etch1+lenny12.0.0.6-12.0.0.7-12.0.0.7-22.0.0.8-12.0.0.9-12.0.0.9-2 |
2.0.0.13-0etch1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1240 is a medium vulnerability (CVSS 5.0) in Mozilla Firefox, published March 27, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.22%, the 88th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/490196/100/0/threaded
secunia.com/advisories/29541
debian.org/security/2008/dsa-1532
Show 22 moreShow less
sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1
ubuntu.com/usn/usn-592-1
vupen.com/english/advisories/2008/1793/references
exchange.xforce.ibmcloud.com/vulnerabilities/41458
lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
mozilla.org/security/announce/2008/mfsa2008-18.html
us-cert.gov/cas/techalerts/TA08-087A.html
gentoo.org/security/en/glsa/glsa-200805-18.xml
wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
mandriva.com/security/advisories?name=MDVSA-2008:080
nvd.nist.gov/vuln/detail/CVE-2008-1240
github.com/advisories/GHSA-8mpj-g6c5-r6j3