CVE-2007-3656

Firefox < 1.8.0.13 and 1.8.1.x < 1.8.1.5 - Exposure of Sensitive Information via wyciwyg URI Handling

Title source: llm

Description

Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via (1) HTTP 302 redirect controls, (2) XMLHttpRequest, or (3) view-source URIs.

References (45)

Core 45

Core References

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/usn-490-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1018411

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9105

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/473191/100/0/threaded

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26107

Various Sources x_refsource_confirm

http://www.mozilla.org/security/announce/2007/mfsa2007-24.html

Exploit x_refsource_misc

http://lcamtuf.coredump.cx/ffcache/

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/38028

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26179

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/4256

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/25589

Third Party Advisory third-party-advisory x_refsource_sreason

http://securityreason.com/securityalert/2872

Vendor Advisory vendor-advisory x_refsource_hp

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2007/dsa-1339

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/25990

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26151

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28135

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26216

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26103

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26072

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26149

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2007/dsa-1337

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26211

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26159

Vendor Advisory vendor-advisory x_refsource_suse

http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2007/dsa-1338

Vendor Advisory x_refsource_confirm

ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Vendor Advisory x_refsource_confirm

http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Exploit x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=387333

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/474542/100/0/threaded

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26258

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26460

Vendor Advisory vendor-advisory x_refsource_sgi

ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2007-0724.html

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/474226/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/24831

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26271

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2007-0722.html

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/35298

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26204

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/26205

Scores

EPSS 0.0197

EPSS Percentile 78.0%

Details

CWE

CWE-200

Status published

Products (31)

mozilla/firefox 1.0

mozilla/firefox 1.0.1

mozilla/firefox 1.0.2

mozilla/firefox 1.0.3

mozilla/firefox 1.0.4

mozilla/firefox 1.0.5

mozilla/firefox 1.0.6

mozilla/firefox 1.0.7

mozilla/firefox 1.0.8

mozilla/firefox 1.5

... and 21 more

Published Jul 10, 2007

Tracked Since Feb 18, 2026