CVE-2007-5947

Mozilla Firefox <2.0.0.10 & SeaMonkey <1.1.7 - XSS

Title source: llm
STIX 2.1

Description

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.

References (61)

Core 61
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27816
Various Sources x_refsource_confirm
http://browser.netscape.com/releasenotes/
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27855
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1424
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200712-21.xml
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-1995
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28277
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27845
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-1083.html
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
Issue Tracking x_refsource_misc
http://bugs.gentoo.org/show_bug.cgi?id=200909
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9873
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0643
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-1082.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27605
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28016
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:246
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/546-1/
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/4018
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/488971/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27838
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/488002/100/0/threaded
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/4002
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/26385
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/715737
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27793
Issue Tracking x_refsource_misc
http://bugs.gentoo.org/show_bug.cgi?id=198965
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0083
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27955
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/Advisories:rPSA-2008-0093
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-546-2
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27957
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/38356
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28398
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29164
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28001
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27796
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018928
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-1984
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27797
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27979
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28171
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27800
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-1084.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1425
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=369814
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3818
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27944

Scores

EPSS 0.0271
EPSS Percentile 84.3%

Details

CWE
CWE-79
Status published
Products (15)
mozilla/firefox 2.0.0.1
mozilla/firefox 2.0.0.2
mozilla/firefox 2.0.0.3
mozilla/firefox 2.0.0.4
mozilla/firefox 2.0.0.5
mozilla/firefox 2.0.0.6
mozilla/firefox 2.0.0.7
mozilla/firefox 2.0.0.8
mozilla/firefox < 2.0.0.9
mozilla/seamonkey 1.1.1
... and 5 more
Published Nov 14, 2007
Tracked Since Feb 18, 2026