CVE-2008-5022: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-origin policy and execute arbitrary script via multiple listeners, which bypass the inner window check.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only; version 8.10 only
• Debian Debian Linux: version 4.0 only
• Mozilla Firefox: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18); from 3.0, before 3.0.4 (fixed in 3.0.4)
• Mozilla Seamonkey: from 1.0, before 1.1.13 (fixed in 1.1.13)
• Mozilla Thunderbird: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18)

Published 2008-11-13. Last modified 2026-06-16.