CVE-2008-5013
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when...
9.3 HighFix available
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
Exploit likelihood
4.77%Down 5.1 points since Feb 4, 2022
What each source reports
NVD Score used
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
- Record
CVE-2008-5013- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
- Record
CVE-2008-5013- Updated
- 2026-11-02
EUVDEUVD-2008-4992 No score
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
- Record
EUVD-2008-4992- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7pc8-c743-pmjf No score
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when...
Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address.
- Record
GHSA-7pc8-c743-pmjf- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xulrunnerDebian:4.0 |
before 1.8.0.15~pre080614h-0etch1, plus listed versions 1.8.0.11-21.8.0.11-31.8.0.11-41.8.0.11-4.11.8.0.12-0etch1 Show 12 moreShow less1.8.0.13~pre070720-0etch11.8.0.13~pre070720-0etch21.8.0.13~pre070720-0etch31.8.0.13~pre070720-0etch3+lenny11.8.0.14~pre071019b-0etch11.8.0.14~pre071019b-0lenny11.8.0.14~pre071019c-0etch11.8.0.15~pre080131a-0etch11.8.0.15~pre080131b-0etch11.8.0.15~pre080323b-0etch11.8.0.15~pre080323b-0etch21.8.0.15~pre080614d-0etch1 |
1.8.0.15~pre080614h-0etch1 |
iceweaselDebian:4.0 |
before 2.0.0.18-0etch1, plus listed versions 2.0.0.10-0etch12.0.0.10-12.0.0.10-22.0.0.11-12.0.0.12-0etch1 Show 27 moreShow less2.0.0.12-12.0.0.12-22.0.0.13-0etch12.0.0.13-12.0.0.14-0etch12.0.0.14-12.0.0.14-22.0.0.15-0etch12.0.0.16-0etch12.0.0.17-0etch12.0.0.3-12.0.0.3-22.0.0.4-0etch12.0.0.4-12.0.0.5-0etch12.0.0.5-0etch1+lenny12.0.0.5-12.0.0.5-22.0.0.6+2.0.0.8-0etch12.0.0.6-0etch12.0.0.6-0etch1+lenny12.0.0.6-12.0.0.7-12.0.0.7-22.0.0.8-12.0.0.9-12.0.0.9-2 |
2.0.0.18-0etch1 |
iceapeDebian:4.0 |
before 1.0.13~pre080614i-0etch1, plus listed versions 1.0.10~pre070720-0etch11.0.10~pre070720-0etch1+lenny11.0.10~pre070720-0etch31.0.10~pre070720-0etch3+lenny11.0.11~pre071022-0etch1 Show 8 moreShow less1.0.11~pre071022-0etch1+lenny11.0.12~pre080131b-0etch11.0.12~pre080131b-0etch21.0.13~pre080323b-0etch11.0.13~pre080323b-0etch21.0.13~pre080323b-0etch31.0.8-41.0.9-0etch1 |
1.0.13~pre080614i-0etch1 |
seamonkeyRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-chatRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-develRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-js-debuggerRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-mailRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nsprRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
Show 105 moreShow less
| Package | Affected | Fixed |
|---|---|---|
seamonkey-nspr-develRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nssRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nss-develRed Hat:enterprise_linux:2.1::as |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkeyRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-chatRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-develRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-js-debuggerRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-mailRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nsprRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nspr-develRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nssRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nss-develRed Hat:enterprise_linux:2.1::aw |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkeyRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-chatRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-develRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-js-debuggerRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-mailRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nsprRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nspr-develRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nssRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nss-develRed Hat:enterprise_linux:2.1::es |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkeyRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-chatRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-develRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-js-debuggerRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-mailRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nsprRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nspr-develRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nssRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkey-nss-develRed Hat:enterprise_linux:2.1::ws |
before 0:1.0.9-0.21.el2 | 0:1.0.9-0.21.el2 |
seamonkeyRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-develRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::as |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkeyRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkeyRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-develRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::es |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkeyRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.9-0.25.el3 | 0:1.0.9-0.25.el3 |
seamonkeyRed Hat:enterprise_linux:4::as |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::as |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-develRed Hat:enterprise_linux:4::as |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::as |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::as |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::as |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkeyRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-develRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::desktop |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkeyRed Hat:enterprise_linux:4::es |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::es |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-develRed Hat:enterprise_linux:4::es |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::es |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::es |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::es |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkeyRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-develRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::ws |
before 0:1.0.9-28.el4 | 0:1.0.9-28.el4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5013 is a high vulnerability (CVSS 9.3) in Mozilla Firefox, published November 13, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.77%, the 91st percentile. Fixed in xulrunner 1.8.0.15~pre080614h-0etch1.
References
vupen.com/english/advisories/2008/3146
debian.org/security/2009/dsa-1697
securityfocus.com/bid/32281
redhat.com/archives/fedora-package-announce/2008-November/msg00366.html
Show 76 moreShow less
secunia.com/advisories/32778
bugzilla.mozilla.org/show_bug.cgi?id=433610
sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
lists.opensuse.org/opensuse-security-announce/2008-11/msg00004.html
us-cert.gov/cas/techalerts/TA08-319A.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9660
securitytracker.com/id?1021181
mozilla.org/security/announce/2008/mfsa2008-49.html
mandriva.com/security/advisories?name=MDVSA-2008:228
ubuntu.com/usn/usn-667-1
nvd.nist.gov/vuln/detail/CVE-2008-5013
github.com/advisories/GHSA-7pc8-c743-pmjf
access.redhat.com/errata/RHSA-2008:0977
bugzilla.redhat.com/show_bug.cgi?id=470864
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0977.json
cve.org/CVERecord?id=CVE-2008-0017