PT-2007-6407 · Mozilla+1 · Firefox+2

Published 2007-10-19 · Updated 2018-10-15 · CVE-2007-5338

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 2.0.0.8 SeaMonkey versions prior to 1.1.5

Description: The issue allows remote attackers to execute arbitrary Javascript with user privileges. This is achieved by using the Script object to modify XPCNativeWrappers, causing the script to be executed when a chrome action is performed.

Recommendations: For Mozilla Firefox versions prior to 2.0.0.8, update to version 2.0.0.8 or later. For SeaMonkey versions prior to 1.1.5, update to version 1.1.5 or later.

Fix

RCE

Weakness Enumeration

CWE-264

CWE-16

Related Identifiers

CVE-2007-5338

DSA-1392-1

DSA-1396-1

DSA-1401-1

DSA-1534-2

DTSA-69-1

DTSA-80-1

HPSBUX02153

RHSA-2007:0979

RHSA-2007:0980

RHSA-2007:0981

RHSA-2007_0979

RHSA-2007_0980

RHSA-2007_0981

Affected Products

Firefox

Red Hat

Seamonkey

References · 195

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5947 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0996 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2867 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5959 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5340 · Security Note
• http://secunia.com/advisories/27315 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4340 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2784 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2777 · Security Note
• http://vupen.com/english/advisories/2007/3544 · Vendor Advisory