PT-2007-6892 · Mozilla+1 · Firefox+2

Published 2007-11-26 · Updated 2023-02-13 · CVE-2007-5960

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 2.0.0.10 SeaMonkey versions prior to 1.1.7

Description The issue allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes. This is achieved by setting window.location and using a modal alert dialog, causing the wrong Referer to be sent.

Recommendations For Mozilla Firefox versions prior to 2.0.0.10, update to version 2.0.0.10 or later. For SeaMonkey versions prior to 1.1.7, update to version 1.1.7 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5960

DSA-1424-1

DSA-1425-1

DSA-1506-1

HPSBUX02153

RHSA-2007:1082

RHSA-2007:1083

RHSA-2007:1084

RHSA-2007_1082

RHSA-2007_1083

RHSA-2007_1084

Affected Products

Firefox

Red Hat

Seamonkey

References · 196

• http://secunia.com/advisories/27855 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2780 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3656 · Security Note
• http://secunia.com/advisories/27845 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5747 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6589 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-November/msg01011.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0994 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:246 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2783 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0995 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2894 · Security Note
• https://bdu.fstec.ru/vul/2015-09531 · Security Note