PT-2007-2512 · Mozilla+1 · Firefox+1

Publicado 2007-02-23 · Atualizado 2018-10-16 · CVE-2007-1084

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 2.0.0.1 and earlier

Description The issue allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme. This bookmarklet is executed in the context of the last visited web page, potentially leading to unauthorized actions.

Recommendations For Mozilla Firefox versions 2.0.0.1 and earlier, consider disabling the ability to save bookmarklets until a patch is available. As a temporary workaround, users should be cautious when saving bookmarklets and avoid saving those with a data: scheme to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2007-1084

Produtos afetados

Debian

Firefox

Referências · 18

• https://nvd.nist.gov/vuln/detail/CVE-2007-1084 · Nota de Segurança
• http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0490.html · Nota
• http://securityfocus.com/archive/1/460890/100/0/threaded · Nota
• http://heise-security.co.uk/news/85728 · Nota
• http://securityfocus.com/archive/1/460885/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2007-1084 · Aviso do Fabricante
• http://lcamtuf.coredump.cx/ffbook · Nota
• http://securityfocus.com/archive/1/460896/100/0/threaded · Nota
• http://securityreason.com/securityalert/2304 · Nota
• http://securityfocus.com/archive/1/461021/100/0/threaded · Nota
• http://osvdb.org/33803 · Nota
• https://security-tracker.debian.org/tracker/source-package/epiphany-browser · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=371179 · Nota
• http://securityfocus.com/bid/22666 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1084 · Nota de Segurança