CVE-2008-5508

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow remote attackers to misrepresent URLs and simplify phishing attacks.

• CWE-20

• http://secunia.com/advisories/33184Third Party Advisory
• http://secunia.com/advisories/33188Third Party Advisory
• http://secunia.com/advisories/33189Third Party Advisory
• http://secunia.com/advisories/33203Third Party Advisory
• http://secunia.com/advisories/33204Third Party Advisory
• http://secunia.com/advisories/33205Third Party Advisory
• http://secunia.com/advisories/33216Third Party Advisory
• http://secunia.com/advisories/33231Third Party Advisory
• http://secunia.com/advisories/33408Third Party Advisory
• http://secunia.com/advisories/33415Third Party Advisory
• http://secunia.com/advisories/33421Third Party Advisory
• http://secunia.com/advisories/33433Third Party Advisory
• http://secunia.com/advisories/33434Third Party Advisory
• http://secunia.com/advisories/33523Third Party Advisory
• http://secunia.com/advisories/33547Third Party Advisory
• http://secunia.com/advisories/34501Third Party Advisory
• http://secunia.com/advisories/35080Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1Broken Link
• http://www.debian.org/security/2009/dsa-1696Third Party Advisory
• http://www.debian.org/security/2009/dsa-1697Third Party Advisory
• http://www.debian.org/security/2009/dsa-1704Third Party Advisory
• http://www.debian.org/security/2009/dsa-1707Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:244Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:245Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:012Third Party Advisory
• http://www.mozilla.org/security/announce/2008/mfsa2008-66.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1036.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1037.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2009-0002.htmlThird Party Advisory
• http://www.securityfocus.com/bid/32882Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1021426Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-690-2Third Party Advisory
• http://www.ubuntu.com/usn/usn-701-1Third Party Advisory
• http://www.ubuntu.com/usn/usn-701-2Third Party Advisory
• http://www.vupen.com/english/advisories/2009/0977Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=425046Issue Tracking, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=460803Issue Tracking, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47414Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11040Third Party Advisory
• https://usn.ubuntu.com/690-1/Third Party Advisory
• http://secunia.com/advisories/33184Third Party Advisory
• http://secunia.com/advisories/33188Third Party Advisory
• http://secunia.com/advisories/33189Third Party Advisory
• http://secunia.com/advisories/33203Third Party Advisory
• http://secunia.com/advisories/33204Third Party Advisory
• http://secunia.com/advisories/33205Third Party Advisory
• http://secunia.com/advisories/33216Third Party Advisory
• http://secunia.com/advisories/33231Third Party Advisory
• http://secunia.com/advisories/33408Third Party Advisory
• http://secunia.com/advisories/33415Third Party Advisory
• http://secunia.com/advisories/33421Third Party Advisory
• http://secunia.com/advisories/33433Third Party Advisory
• http://secunia.com/advisories/33434Third Party Advisory
• http://secunia.com/advisories/33523Third Party Advisory
• http://secunia.com/advisories/33547Third Party Advisory
• http://secunia.com/advisories/34501Third Party Advisory
• http://secunia.com/advisories/35080Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1Broken Link
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-258748-1Broken Link
• http://www.debian.org/security/2009/dsa-1696Third Party Advisory
• http://www.debian.org/security/2009/dsa-1697Third Party Advisory
• http://www.debian.org/security/2009/dsa-1704Third Party Advisory
• http://www.debian.org/security/2009/dsa-1707Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:244Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:245Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:012Third Party Advisory
• http://www.mozilla.org/security/announce/2008/mfsa2008-66.htmlVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1036.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2008-1037.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2009-0002.htmlThird Party Advisory
• http://www.securityfocus.com/bid/32882Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1021426Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-690-2Third Party Advisory
• http://www.ubuntu.com/usn/usn-701-1Third Party Advisory
• http://www.ubuntu.com/usn/usn-701-2Third Party Advisory
• http://www.vupen.com/english/advisories/2009/0977Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=425046Issue Tracking, Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=460803Issue Tracking, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47414Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11040Third Party Advisory
• https://usn.ubuntu.com/690-1/Third Party Advisory

Published

Dec 17, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-5502The layout engine in Mozilla Firefox 3.x before 3.0.5, Thund…
• CVE-2008-5503The loadBindingDocument function in Mozilla Firefox 2.x befo…
• CVE-2008-5504Mozilla Firefox 2.x before 2.0.0.19 allows remote attackers …
• CVE-2008-5505Mozilla Firefox 3.x before 3.0.5 allows remote attackers to …
• CVE-2008-5506Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Th…
• CVE-2008-5507Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Th…
• CVE-2008-5509Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2008-5510The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x b…
• CVE-2008-5511Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Th…
• CVE-2008-5512Multiple unspecified vulnerabilities in Mozilla Firefox 3.x …
• CVE-2008-5513Unspecified vulnerability in the session-restore feature in …
• CVE-2008-5514Off-by-one error in the rfc822_output_char function in the R…