Every CVE Search/ Get API key

CVE-2008-4070

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12...

10.0 High

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."

Exploit likelihood

7.35%Down 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."

Record
CVE-2008-4070
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."

Record
CVE-2008-4070
Updated
2026-11-02
EUVDEUVD-2008-4055 No score

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."

Record
EUVD-2008-4055
Updated
2026-11-03
GitHub AdvisoriesGHSA-47xq-mwq7-mw56 No score

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12...

Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."

Record
GHSA-47xq-mwq7-mw56
Weakness
CWE-119
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
icedove
Debian:4.0
From an advisory covering 28 CVEs
 before 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1, plus listed versions
1.5.0.10.dfsg1-31.5.0.12.dfsg1-0etch11.5.0.12.dfsg1-0etch1+lenny11.5.0.13+1.5.0.14b.dfsg1-0etch11.5.0.13+1.5.0.14b.dfsg1-0lenny1
Show 5 moreShow less
1.5.0.13+1.5.0.15a.dfsg1-0etch11.5.0.13+1.5.0.15b.dfsg1+prepatch080417a-0etch11.5.0.13+1.5.0.15b.dfsg1+prepatch080614d-0etch11.5.0.13+1.5.0.15b.dfsg1-0etch11.5.0.13+1.5.0.15b.dfsg1-0etch2
1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1
iceape
Debian:4.0
From an advisory covering 47 CVEs
 before 1.0.13~pre080614i-0etch1, plus listed versions
1.0.10~pre070720-0etch11.0.10~pre070720-0etch1+lenny11.0.10~pre070720-0etch31.0.10~pre070720-0etch3+lenny11.0.11~pre071022-0etch1
Show 8 moreShow less
1.0.11~pre071022-0etch1+lenny11.0.12~pre080131b-0etch11.0.12~pre080131b-0etch21.0.13~pre080323b-0etch11.0.13~pre080323b-0etch21.0.13~pre080323b-0etch31.0.8-41.0.9-0etch1
1.0.13~pre080614i-0etch1
thunderbird
Red Hat:enterprise_linux:4::as
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
thunderbird-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
thunderbird
Red Hat:enterprise_linux:4::desktop
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
thunderbird-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
thunderbird
Red Hat:enterprise_linux:4::es
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
thunderbird-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
thunderbird
Red Hat:enterprise_linux:4::ws
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
thunderbird-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 12 CVEs
 before 0:1.5.0.12-16.el4
0:1.5.0.12-16.el4
Show 5 moreShow less
Affected packages
PackageAffectedFixed
thunderbird
Red Hat:enterprise_linux:5::client
From an advisory covering 12 CVEs
 before 0:2.0.0.17-1.el5
0:2.0.0.17-1.el5
thunderbird-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 12 CVEs
 before 0:2.0.0.17-1.el5
0:2.0.0.17-1.el5
thunderbird
Red Hat:rhel_productivity:5
From an advisory covering 12 CVEs
 before 0:2.0.0.17-1.el5
0:2.0.0.17-1.el5
thunderbird-debuginfo
Red Hat:rhel_productivity:5
From an advisory covering 12 CVEs
 before 0:2.0.0.17-1.el5
0:2.0.0.17-1.el5
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-4070 is a high vulnerability (CVSS 10.0) in Mozilla Seamonkey, published September 27, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.35%, the 94th percentile. No source names a fixed version.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 271 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open