CVE-2007-4357

Mozilla Firefox < 2.0.0.6 - Status Bar Spoofing via Data URI

Title source: llm

Description

Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified.

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/475531/100/100/threaded

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/475467/100/100/threaded

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/475651/100/0/threaded

Exploit x_refsource_misc

http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/476062/100/0/threaded

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/475970/100/0/threaded

Exploit x_refsource_misc

http://www.eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html

Scores

EPSS 0.0133

EPSS Percentile 67.9%

Details

Status published

Products (1)

mozilla/firefox < 2.0.0.6

Published Aug 15, 2007

Tracked Since Feb 18, 2026