CVE-2008-5023: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days.

Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding CSS property in a signed JAR file.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only; version 8.10 only
• Debian Debian Linux: version 4.0 only
• Mozilla Firefox: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18); from 3.0, before 3.0.4 (fixed in 3.0.4)
• Mozilla Seamonkey: from 1.0, before 1.1.13 (fixed in 1.1.13)

Published 2008-11-13. Last modified 2026-06-16.