CVE-2008-5019: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 3.1% chance of exploitation in the next 30 days.

The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaScript with chrome privileges via unknown vectors.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only; version 8.10 only
• Debian Debian Linux: version 4.0 only
• Mozilla Firefox: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18); from 3.0, before 3.0.4 (fixed in 3.0.4)

Published 2008-11-13. Last modified 2026-06-16.