PT-2007-2512 · Mozilla+1 · Firefox+1

Published 2007-02-23 · Updated 2018-10-16 · CVE-2007-1084

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 2.0.0.1 and earlier

Description The issue allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme. This bookmarklet is executed in the context of the last visited web page, potentially leading to unauthorized actions.

Recommendations For Mozilla Firefox versions 2.0.0.1 and earlier, consider disabling the ability to save bookmarklets until a patch is available. As a temporary workaround, users should be cautious when saving bookmarklets and avoid saving those with a data: scheme to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2007-1084

Affected Products

Debian

Firefox

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2007-1084 · Security Note
• https://osv.dev/vulnerability/CVE-2007-1084 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/epiphany-browser · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1084 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-1084 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1084 · Vendor Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0490.html · Note
• http://securityfocus.com/archive/1/460890/100/0/threaded · Note
• http://heise-security.co.uk/news/85728 · Note
• http://securityfocus.com/archive/1/460885/100/0/threaded · Note
• http://lcamtuf.coredump.cx/ffbook · Note
• http://securityfocus.com/archive/1/460896/100/0/threaded · Note
• http://securityreason.com/securityalert/2304 · Note
• http://securityfocus.com/archive/1/461021/100/0/threaded · Note
• http://osvdb.org/33803 · Note