CVSS: 6.8EPSS: 4%CPEs: 45EXPL: 1CVE-2007-3285 – Mozilla Firefox 10.0 Local Null Byte Bypass File Check Execution
https://notcve.org/view.php?id=CVE-2007-3285
Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would. Mozilla Firefox versiones anteriores a 2.0.0.5, cuando se ejecuta en Windows, permite a atacantes remotos omitir las comprobaciones del tipo de archivo y posiblemente ejecutar programas por medio de un URI (1) file:/// o (2) resource: con una extensión peligrosa, seguido de un byte NULL (%00) y una extensión más segura, lo que hace que Firefox trate el archivo solicitado de manera diferente a como lo haría Windows. • ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://osvdb.org/38032 http://secunia.com/advisories/26072 http://secunia.com/advisories/26149 http://secunia.com/advisories/26204 http://secunia.com/advisories/26216 http://secunia.com/advisories/26258 http://secunia.com/advisories/26271 http://secunia.com/advisories/28135 http://sunsolve.sun.com/search/document.do?assetkey=1-26-10 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 94%CPEs: 41EXPL: 0CVE-2007-3089
https://notcve.org/view.php?id=CVE-2007-3089
Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code that intercepts keystroke values from window.event, aka the "promiscuous IFRAME access bug," a related issue to CVE-2006-4568. Mozilla Firefox anterior a versión 2.0.0.5 no impide el uso de document.write para reemplazar un IFRAME (1) durante la etapa de carga o (2) en el caso de una trama about:blank, que permite a los atacantes remotos mostrar HTML arbitrario o ejecutar cierto código JavaScript, como es demostrado por el código que intercepta los valores de pulsación de teclas (keystroke) de window.event, también se conoce como el "promiscuous IFRAME access bug," un problema relacionado con el CVE-2006-4568. • ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://lcamtuf.coredump.cx/ifsnatch http://osvdb.org/38024 http://secunia.com/advisories/25589 http://secunia.com/advisories/26072 http://secunia.com/advisories/26095 http://secunia.com/advisories&# •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 2CVE-2007-3072
https://notcve.org/view.php?id=CVE-2007-3072
Directory traversal vulnerability in Mozilla Firefox before 2.0.0.4 on Windows allows remote attackers to read arbitrary files via ..%5C (dot dot encoded backslash) sequences in a resource:// URI. Vulnerabilidad de escalado de directorio en el ozilla Firefox anterior a la 2.0.0.4 bajo Windows permite a atacantes remotos leer ficheros de su elección mediante secuencias ..%5C (punto punto codificación barra inversa) en un URI resource://. • http://ha.ckers.org/blog/20070516/read-firefox-settings-poc http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/#comment-35888 http://larholm.com/2007/05/25/firefox-0day-local-file-reading http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004 http://osvdb.org/35922 http://secunia.com/advisories/25481 http://www.securityfocus.com/archive/1/470500/100/0/threaded https://bugzilla.mozilla.org/show_bug.cgi?id=367428 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 5%CPEs: 43EXPL: 0CVE-2007-3073
https://notcve.org/view.php?id=CVE-2007-3073
Directory traversal vulnerability in Mozilla Firefox 2.0.0.4 and earlier on Mac OS X and Unix allows remote attackers to read arbitrary files via ..%2F (dot dot encoded slash) sequences in a resource:// URI. Vulnerabilidad de salto de directorio en Mozilla Firefox 2.0.0.4 y anteriores en Mac OS X y Unix permite a atacantes remotos leer archivos de su elección mediante secuencias ..%2F (punto punto, barra codificada) en un URI resource://. • http://ha.ckers.org/blog/20070516/read-firefox-settings-poc http://larholm.com/2007/05/25/firefox-0day-local-file-reading http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004 http://osvdb.org/35920 http://secunia.com/advisories/25481 http://www.securityfocus.com/archive/1/470500/100/0/threaded https://bugzilla.mozilla.org/show_bug.cgi?id=367428 https://bugzilla.mozilla.org/show_bug.cgi?id=380994 •
CVSS: 4.3EPSS: 2%CPEs: 5EXPL: 3CVE-2007-3074
https://notcve.org/view.php?id=CVE-2007-3074
Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox installation directory via a resource:// URI. Mozilla Firefox 2.0.0.4 y anteriores permite a atacantes remotos leer ficheros del directorio local de instalación de Firefox mediante un URI resource://. • http://ha.ckers.org/blog/20070516/read-firefox-settings-poc http://larholm.com/2007/05/25/firefox-0day-local-file-reading http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004 http://osvdb.org/35918 http://secunia.com/advisories/25481 http://www.securityfocus.com/archive/1/470500/100/0/threaded https://bugzilla.mozilla.org/show_bug.cgi?id=367428 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •