Description
Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.
Published: 2008-07-17
Score: 2.6 Low
EPSS: 6.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-1614-1 New iceweasel packages fix several vulnerabilities
Debian DSA Debian DSA DSA-1615-1 New xulrunner packages fix several vulnerabilities
Debian DSA Debian DSA DSA-1697-1 New iceape packages fix several vulnerabilities
EUVD EUVD EUVD-2008-2926 Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.
Ubuntu USN Ubuntu USN USN-623-1 Firefox vulnerabilities
Ubuntu USN Ubuntu USN USN-626-1 Firefox and xulrunner vulnerabilities
References
Link Providers
http://secunia.com/advisories/31106 cve-icon cve-icon
http://secunia.com/advisories/31120 cve-icon cve-icon
http://secunia.com/advisories/31121 cve-icon cve-icon
http://secunia.com/advisories/31129 cve-icon cve-icon
http://secunia.com/advisories/31145 cve-icon cve-icon
http://secunia.com/advisories/31157 cve-icon cve-icon
http://secunia.com/advisories/31176 cve-icon cve-icon
http://secunia.com/advisories/31183 cve-icon cve-icon
http://secunia.com/advisories/31261 cve-icon cve-icon
http://secunia.com/advisories/31270 cve-icon cve-icon
http://secunia.com/advisories/31306 cve-icon cve-icon
http://secunia.com/advisories/31377 cve-icon cve-icon
http://secunia.com/advisories/33433 cve-icon cve-icon
http://secunia.com/advisories/34501 cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-200808-03.xml cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1 cve-icon cve-icon
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0238 cve-icon cve-icon
http://www.debian.org/security/2008/dsa-1614 cve-icon cve-icon
http://www.debian.org/security/2008/dsa-1615 cve-icon cve-icon
http://www.debian.org/security/2009/dsa-1697 cve-icon cve-icon
http://www.kb.cert.org/vuls/id/130923 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2008:148 cve-icon cve-icon
http://www.mozilla.org/security/announce/2008/mfsa2008-35.html cve-icon cve-icon
http://www.novell.com/support/search.do?cmd=displayKC&docType=kc&externalId=InfoDocument-patchbuilder-readme5031400 cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2008-0597.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2008-0598.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/494860/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/30242 cve-icon cve-icon
http://www.securitytracker.com/id?1020500 cve-icon cve-icon
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.380974 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-623-1 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-626-1 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-626-2 cve-icon cve-icon
http://www.vupen.com/english/advisories/2009/0977 cve-icon cve-icon
https://bugzilla.mozilla.org/show_bug.cgi?id=441120 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/43832 cve-icon cve-icon
https://issues.rpath.com/browse/RPL-2683 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2008-2933 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11618 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2008-2933 cve-icon
History

No history.

Subscriptions

Mozilla Firefox
Redhat Enterprise Linux Rhel Eus
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T09:21:34.997Z

Reserved: 2008-06-30T00:00:00.000Z

Link: CVE-2008-2933

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2008-07-17T13:41:00.000

Modified: 2026-04-23T00:35:47.467

Link: CVE-2008-2933

cve-icon Redhat

Severity : Moderate

Publid Date: 2008-07-15T00:00:00Z

Links: CVE-2008-2933 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses