CVE-2008-5502

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corruption, related to the GetXMLEntity and FastAppendChar functions.

• CWE-399

• http://secunia.com/advisories/33188Third Party Advisory
• http://secunia.com/advisories/33189Third Party Advisory
• http://secunia.com/advisories/33203Third Party Advisory
• http://secunia.com/advisories/33216Third Party Advisory
• http://secunia.com/advisories/33421Third Party Advisory
• http://secunia.com/advisories/34501Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:245Third Party Advisory
• http://www.mozilla.org/security/announce/2008/mfsa2008-60.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1036.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1037.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2009-0002.htmlThird Party Advisory
• http://www.securityfocus.com/bid/32882Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1021417Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/0977Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=458679Issue Tracking, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47408Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10001Third Party Advisory
• https://usn.ubuntu.com/690-1/Third Party Advisory
• http://secunia.com/advisories/33188Third Party Advisory
• http://secunia.com/advisories/33189Third Party Advisory
• http://secunia.com/advisories/33203Third Party Advisory
• http://secunia.com/advisories/33216Third Party Advisory
• http://secunia.com/advisories/33421Third Party Advisory
• http://secunia.com/advisories/34501Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:245Third Party Advisory
• http://www.mozilla.org/security/announce/2008/mfsa2008-60.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1036.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1037.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2009-0002.htmlThird Party Advisory
• http://www.securityfocus.com/bid/32882Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1021417Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/0977Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=458679Issue Tracking, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47408Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10001Third Party Advisory
• https://usn.ubuntu.com/690-1/Third Party Advisory

Published

Dec 17, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-5496SQL injection vulnerability in showcategory.php in PozScript…
• CVE-2008-5497BandSite CMS 1.1.4 allows remote attackers to bypass authent…
• CVE-2008-5498Array index error in the imageRotate function in PHP 5.2.8 a…
• CVE-2008-5499Unspecified vulnerability in Adobe Flash Player for Linux 10…
• CVE-2008-5500The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.…
• CVE-2008-5501The layout engine in Mozilla Firefox 3.x before 3.0.5, Thund…
• CVE-2008-5503The loadBindingDocument function in Mozilla Firefox 2.x befo…
• CVE-2008-5504Mozilla Firefox 2.x before 2.0.0.19 allows remote attackers …
• CVE-2008-5505Mozilla Firefox 3.x before 3.0.5 allows remote attackers to …
• CVE-2008-5506Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Th…
• CVE-2008-5507Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Th…
• CVE-2008-5508Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Th…