PT-2007-2677 · Mozilla · Firefox

Publicado 2007-03-03 · Atualizado 2018-10-16 · CVE-2007-1256

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 2.0.0.2

Description The issue allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites. This is achieved by repeatedly setting document.location in the onunload attribute when linking to another website.

Recommendations For Mozilla Firefox version 2.0.0.2, consider disabling the use of the onunload attribute until a patch is available. Restrict access to websites that may exploit this issue to minimize the risk of spoofing and unauthorized updates.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-1256

Produtos afetados

Firefox

Referências · 5

• http://marc.info/?l=full-disclosure&m=117259225402112&w=2 · Nota
• http://osvdb.org/35913 · Nota
• http://marc.info/?l=full-disclosure&m=117258301222007&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1256 · Nota de Segurança
• http://securityfocus.com/archive/1/461437/100/0/threaded · Nota