CVE-2008-5913
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10...
4.9 MediumFix available
CVE-2008-5913 is a medium vulnerability (CVSS 4.9) in Mozilla Firefox, published January 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in firefox 0:3.6.4-8.el4.
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
Exploit likelihood
1.14%Down 1.1 points since Feb 4, 2022
What each source reports
NVD Score used
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
- Record
CVE-2008-5913- CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
- Record
CVE-2008-5913- Updated
- 2026-11-02
EUVDEUVD-2008-5883 No score
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
- Record
EUVD-2008-5883- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mj9-f8rr-cqvj No score
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10...
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses a random number generator that is seeded only once per browser session, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack."
- Record
GHSA-7mj9-f8rr-cqvj- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:4::as |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::as |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
firefoxRed Hat:enterprise_linux:4::desktop |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
firefoxRed Hat:enterprise_linux:4::es |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::es |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
firefoxRed Hat:enterprise_linux:4::ws |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
firefox-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:3.6.4-8.el4 | 0:3.6.4-8.el4 |
devhelpRed Hat:enterprise_linux:5::client_workstation |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
devhelp-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
Show 51 moreShow less
| Package | Affected | Fixed |
|---|---|---|
devhelp-develRed Hat:enterprise_linux:5::client_workstation |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
totemRed Hat:enterprise_linux:5::client_workstation |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
totem-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
totem-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
devhelpRed Hat:enterprise_linux:5::client |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
devhelp-debuginfoRed Hat:enterprise_linux:5::client |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
escRed Hat:enterprise_linux:5::client |
before 0:1.1.0-12.el5 | 0:1.1.0-12.el5 |
esc-debuginfoRed Hat:enterprise_linux:5::client |
before 0:1.1.0-12.el5 | 0:1.1.0-12.el5 |
firefoxRed Hat:enterprise_linux:5::client |
before 0:3.6.4-8.el5 | 0:3.6.4-8.el5 |
firefox-debuginfoRed Hat:enterprise_linux:5::client |
before 0:3.6.4-8.el5 | 0:3.6.4-8.el5 |
gnome-python2-extrasRed Hat:enterprise_linux:5::client |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-extras-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-gtkhtml2Red Hat:enterprise_linux:5::client |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-gtkmozembedRed Hat:enterprise_linux:5::client |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-gtkspellRed Hat:enterprise_linux:5::client |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-libeggRed Hat:enterprise_linux:5::client |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
totemRed Hat:enterprise_linux:5::client |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
totem-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
totem-mozpluginRed Hat:enterprise_linux:5::client |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
xulrunnerRed Hat:enterprise_linux:5::client |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
xulrunner-develRed Hat:enterprise_linux:5::client |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
yelpRed Hat:enterprise_linux:5::client |
before 0:2.16.0-26.el5 | 0:2.16.0-26.el5 |
yelp-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.16.0-26.el5 | 0:2.16.0-26.el5 |
devhelpRed Hat:enterprise_linux:5::server |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
devhelp-debuginfoRed Hat:enterprise_linux:5::server |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
devhelp-develRed Hat:enterprise_linux:5::server |
before 0:0.12-21.el5 | 0:0.12-21.el5 |
escRed Hat:enterprise_linux:5::server |
before 0:1.1.0-12.el5 | 0:1.1.0-12.el5 |
esc-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.1.0-12.el5 | 0:1.1.0-12.el5 |
firefoxRed Hat:enterprise_linux:5::server |
before 0:3.6.4-8.el5 | 0:3.6.4-8.el5 |
firefox-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.6.4-8.el5 | 0:3.6.4-8.el5 |
gnome-python2-extrasRed Hat:enterprise_linux:5::server |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-extras-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-gtkhtml2Red Hat:enterprise_linux:5::server |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-gtkmozembedRed Hat:enterprise_linux:5::server |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-gtkspellRed Hat:enterprise_linux:5::server |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
gnome-python2-libeggRed Hat:enterprise_linux:5::server |
before 0:2.14.2-7.el5 | 0:2.14.2-7.el5 |
totemRed Hat:enterprise_linux:5::server |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
totem-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
totem-develRed Hat:enterprise_linux:5::server |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
totem-mozpluginRed Hat:enterprise_linux:5::server |
before 0:2.16.7-7.el5 | 0:2.16.7-7.el5 |
xulrunnerRed Hat:enterprise_linux:5::server |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
xulrunner-develRed Hat:enterprise_linux:5::server |
before 0:1.9.2.4-10.el5 | 0:1.9.2.4-10.el5 |
yelpRed Hat:enterprise_linux:5::server |
before 0:2.16.0-26.el5 | 0:2.16.0-26.el5 |
yelp-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.16.0-26.el5 | 0:2.16.0-26.el5 |
MozillaFirefoxopenSUSE:Tumbleweed |
before 50.1.0-1.1 | 50.1.0-1.1 |
firefox-esropenSUSE:Tumbleweed |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/40481
ubuntu.com/usn/usn-930-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11139
lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html
vupen.com/english/advisories/2010/1640
redhat.com/support/errata/RHSA-2010-0501.html
Show 194 moreShow less
infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html
mandriva.com/security/advisories?name=MDVSA-2010:125
darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161
arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html
ubuntu.com/usn/usn-930-2
lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
trusteer.com/files/In-session-phishing-advisory-2.pdf
mozilla.org/security/announce/2010/mfsa2010-33.html
bugzilla.mozilla.org/show_bug.cgi?id=475585
securityfocus.com/bid/33276
support.avaya.com/css/P8/documents/100091069
nvd.nist.gov/vuln/detail/CVE-2008-5913
github.com/advisories/GHSA-7mj9-f8rr-cqvj
access.redhat.com/errata/RHSA-2010:0500
mozilla.com/en-US/firefox/3.6.4/releasenotes
mozilla.org/security/known-vulnerabilities/firefox35.html
bugzilla.redhat.com/show_bug.cgi?id=480938
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0500.json
cve.org/CVERecord?id=CVE-2008-5913
suse.com/security/cve/CVE-2008-5913
This page doesn't list everything
Left out here: 1,969 references. The JSON record has them.