Description
Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.
References (6)
Core 6
Core References
Various Sources x_refsource_misc
http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/25053
Various Sources x_refsource_misc
http://xs-sniper.com/blog/remote-command-exec-firefox-2005/
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=389106
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=389580
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/783400
Scores
EPSS
0.1966
EPSS Percentile
97.1%
Details
CWE
CWE-78
Status
published
Products (3)
microsoft/internet_explorer
7
mozilla/firefox
2.0.0.5
mozilla/firefox
3.0 alpha
Published
Jul 27, 2007
Tracked Since
Feb 18, 2026