PT-2007-2677 · Mozilla · Firefox

Published 2007-03-03 · Updated 2018-10-16 · CVE-2007-1256

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 2.0.0.2

Description The issue allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites. This is achieved by repeatedly setting document.location in the onunload attribute when linking to another website.

Recommendations For Mozilla Firefox version 2.0.0.2, consider disabling the use of the onunload attribute until a patch is available. Restrict access to websites that may exploit this issue to minimize the risk of spoofing and unauthorized updates.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-1256

Affected Products

Firefox

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-1256 · Security Note
• http://marc.info/?l=full-disclosure&m=117259225402112&w=2 · Note
• http://osvdb.org/35913 · Note
• http://marc.info/?l=full-disclosure&m=117258301222007&w=2 · Note
• http://securityfocus.com/archive/1/461437/100/0/threaded · Note