bugzilla.mozilla.orgConfirmation
http://bugzilla.mozilla.org/show_bug.cgi?id=388121 CVE-2007-3844
Mozilla Firefox/Thunderbird/SeaMonkey - Chrome-Loaded About:Blank Script Execution
Record summary
CVE-2007-3844 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.
Description
Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBMozilla Firefox/Thunderbird/SeaMonkey - Chrome-Loaded About:Blank Script ExecutionExploitDB exploitby moz_bug_r_a4Not analyzed1 file
References
Showing 12 of 56HPSBUX02153Vendor advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 HPSBUX02156Vendor advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579 26234Third-party advisory
http://secunia.com/advisories/26234 26258Third-party advisory
http://secunia.com/advisories/26258 26288Third-party advisory
http://secunia.com/advisories/26288 26303Third-party advisory
http://secunia.com/advisories/26303 26309Third-party advisory
http://secunia.com/advisories/26309 26331Third-party advisory
http://secunia.com/advisories/26331 26335Third-party advisory
http://secunia.com/advisories/26335 26393Third-party advisory
http://secunia.com/advisories/26393 26460Third-party advisory
http://secunia.com/advisories/26460