CVE-2008-5024: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days.

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML injection attacks via the default namespace in an E4X document.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 7.10 only; version 8.04 only; version 8.10 only
• Debian Debian Linux: version 4.0 only
• Mozilla Firefox: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18); from 3.0, before 3.0.4 (fixed in 3.0.4)
• Mozilla Seamonkey: from 1.0, before 1.1.13 (fixed in 1.1.13)
• Mozilla Thunderbird: from 2.0, before 2.0.0.18 (fixed in 2.0.0.18)

Published 2008-11-13. Last modified 2026-06-16.