PT-2007-5080 · Mozilla+1 · Firefox+3

Published 2007-08-08 · Updated 2023-02-13 · CVE-2007-3845

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 2.0.0.6 Thunderbird versions prior to 1.5.0.13 and 2.x prior to 2.0.0.6 SeaMonkey versions prior to 1.1.4

Description: The issue allows remote attackers to execute arbitrary commands via certain vectors associated with launching a file handling program based on the file extension at the end of the URI. It is still possible to launch a filetype handler based on extension rather than the registered protocol handler.

Recommendations: For Mozilla Firefox versions prior to 2.0.0.6, update to version 2.0.0.6 or later. For Thunderbird versions prior to 1.5.0.13, update to version 1.5.0.13 or later. For Thunderbird 2.x versions prior to 2.0.0.6, update to version 2.0.0.6 or later. For SeaMonkey versions prior to 1.1.4, update to version 1.1.4 or later.

Exploit

Fix

Related Identifiers

CVE-2007-3845

DSA-1344-1

DSA-1345-1

DSA-1346-1

DSA-1391-1

DTSA-51-1

DTSA-52-1

DTSA-53-1

DTSA-71-1

HPSBUX02153

Affected Products

Hp-Ux

Firefox

Seamonkey

Thunderbird

References · 168

• 🔥 https://exploit-db.com/exploits/30381 · Exploit
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5947 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0996 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2867 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:047 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-3845 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5959 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5340 · Security Note
• http://debian.org/security/2007/dsa-1346 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462 · Security Note