CVE-2008-3198
Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a...
CVE-2008-3198 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published July 17, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.96%, the 87th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.96%EPSS, 87th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceweaselDebian:4.0 From an advisory covering 3 CVEs | before 2.0.0.16-0etch1, plus listed versions 2.0.0.10-0etch12.0.0.10-12.0.0.10-22.0.0.11-12.0.0.12-0etch1 Show 25 moreShow less2.0.0.12-12.0.0.12-22.0.0.13-0etch12.0.0.13-12.0.0.14-0etch12.0.0.14-12.0.0.14-22.0.0.15-0etch12.0.0.3-12.0.0.3-22.0.0.4-0etch12.0.0.4-12.0.0.5-0etch12.0.0.5-0etch1+lenny12.0.0.5-12.0.0.5-22.0.0.6+2.0.0.8-0etch12.0.0.6-0etch12.0.0.6-0etch1+lenny12.0.0.6-12.0.0.7-12.0.0.7-22.0.0.8-12.0.0.9-12.0.0.9-2 | 2.0.0.16-0etch1 |
devhelpRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
devhelp-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
devhelp-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::client_workstation From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
devhelpRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
devhelp-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:3.0.1-1.el5 | 0:3.0.1-1.el5 |
firefox-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:3.0.1-1.el5 | 0:3.0.1-1.el5 |
nspluginwrapperRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:0.9.91.5-22.el5 | 0:0.9.91.5-22.el5 |
nspluginwrapper-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:0.9.91.5-22.el5 | 0:0.9.91.5-22.el5 |
xulrunnerRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
yelpRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:2.16.0-20.el5 | 0:2.16.0-20.el5 |
yelp-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 3 CVEs | before 0:2.16.0-20.el5 | 0:2.16.0-20.el5 |
devhelpRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
devhelp-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
devhelp-develRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:0.12-18.el5 | 0:0.12-18.el5 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:3.0.1-1.el5 | 0:3.0.1-1.el5 |
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:3.0.1-1.el5 | 0:3.0.1-1.el5 |
nspluginwrapperRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:0.9.91.5-22.el5 | 0:0.9.91.5-22.el5 |
nspluginwrapper-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:0.9.91.5-22.el5 | 0:0.9.91.5-22.el5 |
xulrunnerRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
xulrunner-develRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
xulrunner-devel-unstableRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:1.9.0.1-1.el5 | 0:1.9.0.1-1.el5 |
yelpRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:2.16.0-20.el5 | 0:2.16.0-20.el5 |
yelp-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 3 CVEs | before 0:2.16.0-20.el5 | 0:2.16.0-20.el5 |
What each source reports
NVD Score used
Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.
- Record
CVE-2008-3198- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.
- Record
CVE-2008-3198- Updated
- 2026-11-02
EUVDEUVD-2008-3188No score
Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.
- Record
EUVD-2008-3188- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jrjj-g3cm-58m8No score
Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a...
Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.
- Record
GHSA-jrjj-g3cm-58m8- Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
mozilla.org/security/announce/2008/mfsa2008-35.html
exchange.xforce.ibmcloud.com/vulnerabilities/44199
securityfocus.com/bid/30244
bugzilla.mozilla.org/show_bug.cgi?id=441169
nvd.nist.gov/vuln/detail/CVE-2008-3198
github.com/advisories/GHSA-jrjj-g3cm-58m8
Show 14 moreShow less
access.redhat.com/errata/RHSA-2008:0597
bugzilla.redhat.com/show_bug.cgi?id=452204
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0597.json
cve.org/CVERecord?id=CVE-2008-2785