CVSS: 9.3EPSS: 95%CPEs: 4EXPL: 1CVE-2007-3845 – Multiple Browsers - URI Handlers Command Injection
https://notcve.org/view.php?id=CVE-2007-3845
Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler." Mozilla Firefox anterior a 2.0.0.6, Thunderbird anterior a 1.5.0.13 y 2.x anterior a 2.0.0.6, y SeaMonkey anterior a 1.1.4 permite a atacantes remotos ejecutar código de su elección mediante ciertos vectores asociados con el lanzamiento de "un programa de manejo de ficheros basado en la extensión del fichero al final del URI", una variante de CVE-2007-4041. El vendedor afirma que "todavía es posible lanzar un manipulador de tipo de fichero basado en la extensión en lugar de el manipulador de protocolo registrado". • https://www.exploit-db.com/exploits/30381 http://bugzilla.mozilla.org/show_bug.cgi?id=389580 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579 http://secunia.com/advisories/26234 http://secunia.com/advisories/26258 http://secunia.com/advisories/26303 http://secunia.com/advisories/26309 http://secunia.com/advisories/26331 http://secunia.com/advisories/26335 http://secunia.com •
CVSS: 4.3EPSS: 95%CPEs: 3EXPL: 2CVE-2007-3844 – Mozilla Firefox/Thunderbird/SeaMonkey - Chrome-Loaded About:Blank Script Execution
https://notcve.org/view.php?id=CVE-2007-3844
Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression. Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 y anterior a 1.5.0.13, y SeaMonkey 1.1.3 permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) con privilegios de chrome mediante un complemento que inserta un enlace (1) javascript: o (2)data: dentro de un documento about:blank cargado por chrome a través de (a) la función window.open o (b) una asignación content.location, también conocido como "Secuencia de comandos en Contexto Cruzado (Cross Context Scripting). NOTA: este problema está provocado por una regresión de CVE-2007-3089. • https://www.exploit-db.com/exploits/30439 http://bugzilla.mozilla.org/show_bug.cgi?id=388121 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579 http://secunia.com/advisories/26234 http://secunia.com/advisories/26258 http://secunia.com/advisories/26288 http://secunia.com/advisories/26303 http://secunia.com/advisories/26309 http://secunia.com/advisories/26331 http://secunia.com •
CVSS: 6.8EPSS: 1%CPEs: 9EXPL: 0CVE-2007-4041
https://notcve.org/view.php?id=CVE-2007-4041
Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670. Múltiples vulnerabilidades de inyección de argumento en Mozilla Firefox 2.0.0.5 y 3.0alpha permite a atacantes remotos ejecutar comandos de su elección mediante un byte NULL (%00) y metacaracteres de consola de comandos en URIs (1) mailto, (2) nntp, (3) news, (4) snews, ó (5) telnet, asunto similar a CVE-2007-3670. • http://www.kb.cert.org/vuls/id/783400 http://www.securityfocus.com/bid/25053 http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005 http://xs-sniper.com/blog/remote-command-exec-firefox-2005 https://bugzilla.mozilla.org/show_bug.cgi?id=389106 https://bugzilla.mozilla.org/show_bug.cgi?id=389580 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2007-4038
https://notcve.org/view.php?id=CVE-2007-4038
Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670. Una vulnerabilidad de inyección de argumentos en Mozilla Firefox versiones anteriores a 2.0.0.5, cuando se ejecuta en sistemas con Thunderbird versión 1.5 instalado y ciertas URI registradas, permite a atacantes remotos conducir ataques de tipo cross-browser scripting y ejecutar comandos arbitrarios por medio de metacaracteres shell en una URI mailto, que se insertan en la línea de comandos que es creada al invocar el archivo Thunderbird.exe, un problema similar a CVE-2007-3670. • http://larholm.com/2007/07/25/mozilla-protocol-abuse http://seclists.org/fulldisclosure/2007/Jul/0557.html http://www.securityfocus.com/archive/1/474624/100/0/threaded http://www.securityfocus.com/archive/1/474686/100/0/threaded • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 87%CPEs: 5EXPL: 0CVE-2007-3737
https://notcve.org/view.php?id=CVE-2007-3737
Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified "element outside of a document." Mozilla Firefox versiones anteriores a 2.0.0.5 permite a atacantes remotos ejecutar código de su elección con privilegios "chrome" al invocar un gestor de eventos desde un "elemento fuera del documento" no especificado. • ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 http://secunia.com/advisories/25589 http://secunia.com/advisories/26072 http://secunia.com/advisories/26095 http://secunia.com/advisories/26103 http://secunia.com/advisories/26106 http://secunia.com/advisories/26107 http://secunia.com/advisories/26149 http://secu •