Skip to content
brandefense.io
Request A Demo
WatchlistCritical

CVE-2008-0016Firefox Memory Corruption

Mozilla UTF-8 stack buffer overflow

Published Sep 23, 2008 · Updated Mar 9, 2026 · Also known as DEBIAN-CVE-2008-0016, DEBIAN-CVE-2008-0017, DEBIAN-CVE-2008-3835, DEBIAN-CVE-2008-3836, DEBIAN-CVE-2008-3837, DEBIAN-CVE-2008-4058, DEBIAN-CVE-2008-4059, DEBIAN-CVE-2008-4060, DEBIAN-CVE-2008-4061, DEBIAN-CVE-2008-4062, DEBIAN-CVE-2008-4063, DEBIAN-CVE-2008-4064, DEBIAN-CVE-2008-4065, DEBIAN-CVE-2008-4066, DEBIAN-CVE-2008-4067, DEBIAN-CVE-2008-4068, DEBIAN-CVE-2008-4069, DEBIAN-CVE-2008-4070, DEBIAN-CVE-2008-4582, DEBIAN-CVE-2008-5012, DEBIAN-CVE-2008-5013, DEBIAN-CVE-2008-5014, DEBIAN-CVE-2008-5017, DEBIAN-CVE-2008-5018, DEBIAN-CVE-2008-5021, DEBIAN-CVE-2008-5022, DEBIAN-CVE-2008-5023, DEBIAN-CVE-2008-5024, DEBIAN-CVE-2008-5052, DEBIAN-CVE-2008-5500, DEBIAN-CVE-2008-5503, DEBIAN-CVE-2008-5506, DEBIAN-CVE-2008-5507, DEBIAN-CVE-2008-5508, DEBIAN-CVE-2008-5511, DEBIAN-CVE-2008-5512, DSA-1649-1, DSA-1669-1, DSA-1696-1

Key Facts

Patch immediately
  • CVE-2008-0016 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Firefox (Mozilla), Seamonkey (Mozilla), iceape (debian) and 8 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 44% probability of exploitation in the next 30 days.
  • Fixed versions are available, including devhelp 0:0.10-0.10.el4, iceape 1.0.13~pre080614i-0etch1, icedove 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1.
  • Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v2

10.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS (30-day exploit likelihood)

44%

Higher than 98.7% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

44/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

1

Proof-of-concept links

In-the-wild evidence

0

Reports of active use

Advisories And Exploit References

Description

Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in a link.

Affected Products

83 affected entries in total
ProductAffected versionsFixed in
FirefoxMozilla0.10, 0.10.1, 0.8, 0.9, 0.9.1, 0.9.2, 0.9.3, 0.9-rc2.0.0.16
SeamonkeyMozilla1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.71.1.11
iceapedebianSee advisory1.0.13~pre080614i-0etch1
icedovedebianSee advisory1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1
iceweaseldebianSee advisory2.0.0.17-0etch1
6 more affected products in the full CVE brief

Patched Releases

devhelp

0:0.10-0.10.el4

iceape

1.0.13~pre080614i-0etch1

icedove

1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1

iceweasel

2.0.0.17-0etch1

Firefox

2.0.0.16

Seamonkey

1.1.11, 0:1.0.9-0.20.el2, 0:1.0.9-0.24.el3, 0:1.0.9-26.el4

MozillaThunderbird

91.1.1-1.1

MozillaThunderbird-translations-common

91.1.1-1.1

MozillaThunderbird-translations-other

91.1.1-1.1

thunderbird

0:1.5.0.12-16.el4, 0:2.0.0.17-1.el5, 2.0.0.17-1.0.1.el5

xulrunner

1.8.0.15~pre080614h-0etch1

Timeline

  1. Publicly disclosed

    Sep 23, 2008

  2. Last updated

    Mar 9, 2026

Weakness Type

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-121 Stack-based Buffer Overflow

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2008-0016 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.

Request A Demo

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.