1. CVE-Search
  2. CVE-2007-3844
ID CVE-2007-3844
Summary Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:2.0.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:2.0.0.5:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 15-10-2018 - 21:31)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:N
oval via4
accepted 2013-04-29T04:19:45.581-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.
family unix
id oval:org.mitre.oval:def:9493
status accepted
submitted 2010-07-09T03:56:16-04:00
title Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.
version 30
redhat via4
advisories
  • rhsa
    id RHSA-2007:0979
  • rhsa
    id RHSA-2007:0980
  • rhsa
    id RHSA-2007:0981
rpms
  • firefox-0:1.5.0.12-0.7.el4
  • firefox-0:1.5.0.12-6.el5
  • firefox-debuginfo-0:1.5.0.12-0.7.el4
  • firefox-debuginfo-0:1.5.0.12-6.el5
  • seamonkey-0:1.0.9-0.5.el3
  • seamonkey-0:1.0.9-0.6.el2
  • seamonkey-0:1.0.9-6.el4
  • seamonkey-chat-0:1.0.9-0.5.el3
  • seamonkey-chat-0:1.0.9-0.6.el2
  • seamonkey-chat-0:1.0.9-6.el4
  • seamonkey-debuginfo-0:1.0.9-0.5.el3
  • seamonkey-debuginfo-0:1.0.9-6.el4
  • seamonkey-devel-0:1.0.9-0.5.el3
  • seamonkey-devel-0:1.0.9-0.6.el2
  • seamonkey-devel-0:1.0.9-6.el4
  • seamonkey-dom-inspector-0:1.0.9-0.5.el3
  • seamonkey-dom-inspector-0:1.0.9-0.6.el2
  • seamonkey-dom-inspector-0:1.0.9-6.el4
  • seamonkey-js-debugger-0:1.0.9-0.5.el3
  • seamonkey-js-debugger-0:1.0.9-0.6.el2
  • seamonkey-js-debugger-0:1.0.9-6.el4
  • seamonkey-mail-0:1.0.9-0.5.el3
  • seamonkey-mail-0:1.0.9-0.6.el2
  • seamonkey-mail-0:1.0.9-6.el4
  • seamonkey-nspr-0:1.0.9-0.5.el3
  • seamonkey-nspr-0:1.0.9-0.6.el2
  • seamonkey-nspr-devel-0:1.0.9-0.5.el3
  • seamonkey-nspr-devel-0:1.0.9-0.6.el2
  • seamonkey-nss-0:1.0.9-0.5.el3
  • seamonkey-nss-0:1.0.9-0.6.el2
  • seamonkey-nss-devel-0:1.0.9-0.5.el3
  • seamonkey-nss-devel-0:1.0.9-0.6.el2
  • thunderbird-0:1.5.0.12-0.5.el4
  • thunderbird-0:1.5.0.12-5.el5
  • thunderbird-debuginfo-0:1.5.0.12-0.5.el4
  • thunderbird-debuginfo-0:1.5.0.12-5.el5
refmap via4
bid 25142
bugtraq
  • 20070801 FLEA-2007-0039-1 firefox
  • 20070803 FLEA-2007-0040-1 thunderbird
confirm
debian
  • DSA-1344
  • DSA-1345
  • DSA-1346
  • DSA-1391
fedora
  • FEDORA-2007-2601
  • FEDORA-2007-3431
gentoo GLSA-200708-09
hp
  • HPSBUX02153
  • HPSBUX02156
  • SSRT061181
  • SSRT061236
mandriva
  • MDKSA-2007:152
  • MDVSA-2007:047
  • MDVSA-2008:047
sectrack
  • 1018479
  • 1018480
  • 1018481
secunia
  • 26234
  • 26258
  • 26288
  • 26303
  • 26309
  • 26331
  • 26335
  • 26393
  • 26460
  • 26572
  • 27276
  • 27298
  • 27325
  • 27326
  • 27327
  • 27356
  • 27414
  • 27680
  • 28135
  • 28363
slackware SSA:2007-213-01
sunalert
  • 103177
  • 201516
suse SUSE-SA:2007:057
ubuntu
  • USN-493-1
  • USN-503-1
vupen
  • ADV-2007-3587
  • ADV-2007-4256
  • ADV-2008-0082
statements via4
contributor Mark J Cox
lastmodified 2007-08-17
organization Red Hat
statement Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=250648 The Red Hat Security Response Team has rated this issue as having moderate security impact, a future update may address this flaw.
Last major update 15-10-2018 - 21:31
Published 08-08-2007 - 01:17
Last modified 15-10-2018 - 21:31
Back to Top