Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2007-5960 | First vendor Publication | 2007-11-26 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5960 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17515 | |||
| Oval ID: | oval:org.mitre.oval:def:17515 | ||
| Title: | USN-546-2 -- firefox regression | ||
| Description: | USN-546-1 fixed vulnerabilities in Firefox. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-546-2 CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 | Version: | 7 |
| Platform(s): | Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | firefox |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17693 | |||
| Oval ID: | oval:org.mitre.oval:def:17693 | ||
| Title: | USN-546-1 -- firefox vulnerabilities | ||
| Description: | It was discovered that Firefox incorrectly associated redirected sites as the origin of "jar:" contents. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-546-1 CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 | Product(s): | firefox |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18486 | |||
| Oval ID: | oval:org.mitre.oval:def:18486 | ||
| Title: | DSA-1425-1 xulrunner - several vulnerabilities | ||
| Description: | Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1425-1 CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | xulrunner |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:20371 | |||
| Oval ID: | oval:org.mitre.oval:def:20371 | ||
| Title: | DSA-1424-1 iceweasel - several vulnerabilities | ||
| Description: | Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1424-1 CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | iceweasel |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22596 | |||
| Oval ID: | oval:org.mitre.oval:def:22596 | ||
| Title: | ELSA-2007:1082: firefox security update (Critical) | ||
| Description: | Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:1082-01 CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 | Version: | 17 |
| Platform(s): | Oracle Linux 5 | Product(s): | firefox |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22680 | |||
| Oval ID: | oval:org.mitre.oval:def:22680 | ||
| Title: | ELSA-2007:1083: thunderbird security update (Moderate) | ||
| Description: | Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:1083-01 CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 | Version: | 17 |
| Platform(s): | Oracle Linux 5 | Product(s): | thunderbird |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9794 | |||
| Oval ID: | oval:org.mitre.oval:def:9794 | ||
| Title: | Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent. | ||
| Description: | Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-5960 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for Mozilla File : nvt/sles9p5014847.nasl |
| 2009-04-09 | Name : Mandriva Update for mozilla-firefox MDKSA-2007:246 (mozilla-firefox) File : nvt/gb_mandriva_MDKSA_2007_246.nasl |
| 2009-03-23 | Name : Ubuntu Update for firefox regression USN-546-2 File : nvt/gb_ubuntu_USN_546_2.nasl |
| 2009-03-23 | Name : Ubuntu Update for firefox vulnerabilities USN-546-1 File : nvt/gb_ubuntu_USN_546_1.nasl |
| 2009-03-06 | Name : RedHat Update for thunderbird RHSA-2007:1083-01 File : nvt/gb_RHSA-2007_1083-01_thunderbird.nasl |
| 2009-02-27 | Name : Fedora Update for devhelp FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_devhelp_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for chmsee FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_chmsee_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for epiphany-extensions FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_epiphany-extensions_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for epiphany FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_epiphany_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for firefox FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_firefox_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for galeon FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_galeon_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for gnome-python2-extras FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_gnome-python2-extras_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for gnome-web-photo FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_gnome-web-photo_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for gtkmozembedmm FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_gtkmozembedmm_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for kazehakase FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_kazehakase_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for liferea FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_liferea_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for openvrml FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_openvrml_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for ruby-gnome2 FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_ruby-gnome2_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for yelp FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_yelp_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for seamonkey FEDORA-2007-4098 File : nvt/gb_fedora_2007_4098_seamonkey_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for seamonkey FEDORA-2007-4106 File : nvt/gb_fedora_2007_4106_seamonkey_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for firefox FEDORA-2007-756 File : nvt/gb_fedora_2007_756_firefox_fc6.nasl |
| 2009-02-27 | Name : Fedora Update for blam FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_blam_fc8.nasl |
| 2009-02-27 | Name : CentOS Update for thunderbird CESA-2007:1083 centos4 i386 File : nvt/gb_CESA-2007_1083_thunderbird_centos4_i386.nasl |
| 2009-02-27 | Name : CentOS Update for thunderbird CESA-2007:1083 centos4 x86_64 File : nvt/gb_CESA-2007_1083_thunderbird_centos4_x86_64.nasl |
| 2009-02-27 | Name : Fedora Update for Miro FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_Miro_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for blam FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_blam_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for chmsee FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_chmsee_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for devhelp FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_devhelp_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for epiphany-extensions FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_epiphany-extensions_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for epiphany FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_epiphany_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for firefox FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_firefox_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for galeon FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_galeon_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for gnome-python2-extras FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_gnome-python2-extras_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for gtkmozembedmm FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_gtkmozembedmm_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for kazehakase FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_kazehakase_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for liferea FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_liferea_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for openvrml FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_openvrml_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for ruby-gnome2 FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_ruby-gnome2_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for yelp FEDORA-2007-3952 File : nvt/gb_fedora_2007_3952_yelp_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for Miro FEDORA-2007-3962 File : nvt/gb_fedora_2007_3962_Miro_fc8.nasl |
| 2009-01-28 | Name : SuSE Update for MozillaFirefox SUSE-SA:2007:066 File : nvt/gb_suse_2007_066.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200712-21 (firefox seamonkey) File : nvt/glsa_200712_21.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1425-1 (xulrunner) File : nvt/deb_1425_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2007-333-01 seamonkey File : nvt/esoft_slk_ssa_2007_333_01.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2007-331-01 firefox File : nvt/esoft_slk_ssa_2007_331_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 38868 | Mozilla Multiple Products window.location HTTP Referer Header CSRF |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1084.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-1083.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1082.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071126_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071126_seamonkey_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20071219_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1082.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1084.nasl - Type : ACT_GATHER_INFO |
| 2008-01-10 | Name : The remote openSUSE host is missing a security update. File : suse_epiphany-4870.nasl - Type : ACT_GATHER_INFO |
| 2008-01-08 | Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-4795.nasl - Type : ACT_GATHER_INFO |
| 2007-12-31 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200712-21.nasl - Type : ACT_GATHER_INFO |
| 2007-12-24 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1083.nasl - Type : ACT_GATHER_INFO |
| 2007-12-24 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1083.nasl - Type : ACT_GATHER_INFO |
| 2007-12-17 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-246.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_MozillaFirefox-4757.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-4794.nasl - Type : ACT_GATHER_INFO |
| 2007-12-11 | Name : The remote Fedora host is missing a security update. File : fedora_2007-4106.nasl - Type : ACT_GATHER_INFO |
| 2007-12-11 | Name : The remote Fedora host is missing a security update. File : fedora_2007-4098.nasl - Type : ACT_GATHER_INFO |
| 2007-12-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1425.nasl - Type : ACT_GATHER_INFO |
| 2007-12-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1424.nasl - Type : ACT_GATHER_INFO |
| 2007-12-07 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-546-2.nasl - Type : ACT_GATHER_INFO |
| 2007-12-04 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-756.nasl - Type : ACT_GATHER_INFO |
| 2007-12-03 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : netscape_browser_9004.nasl - Type : ACT_GATHER_INFO |
| 2007-12-02 | Name : A web browser on the remote host is affected by multiple vulnerabilities. File : seamonkey_117.nasl - Type : ACT_GATHER_INFO |
| 2007-11-30 | Name : The remote openSUSE host is missing a security update. File : suse_MozillaFirefox-4758.nasl - Type : ACT_GATHER_INFO |
| 2007-11-30 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-333-01.nasl - Type : ACT_GATHER_INFO |
| 2007-11-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1084.nasl - Type : ACT_GATHER_INFO |
| 2007-11-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1082.nasl - Type : ACT_GATHER_INFO |
| 2007-11-29 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2007-3962.nasl - Type : ACT_GATHER_INFO |
| 2007-11-29 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2007-3952.nasl - Type : ACT_GATHER_INFO |
| 2007-11-29 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-546-1.nasl - Type : ACT_GATHER_INFO |
| 2007-11-29 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-331-01.nasl - Type : ACT_GATHER_INFO |
| 2007-11-27 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_20010.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:15:42 |
|
| 2024-11-28 12:14:00 |
|
| 2024-08-02 12:08:05 |
|
| 2024-08-02 01:02:29 |
|
| 2024-02-02 01:07:41 |
|
| 2024-02-01 12:02:29 |
|
| 2023-09-05 12:07:10 |
|
| 2023-09-05 01:02:20 |
|
| 2023-09-02 12:07:16 |
|
| 2023-09-02 01:02:20 |
|
| 2023-08-12 12:08:30 |
|
| 2023-08-12 01:02:21 |
|
| 2023-08-11 12:07:19 |
|
| 2023-08-11 01:02:25 |
|
| 2023-08-06 12:07:00 |
|
| 2023-08-06 01:02:21 |
|
| 2023-08-04 12:07:05 |
|
| 2023-08-04 01:02:25 |
|
| 2023-07-14 12:07:04 |
|
| 2023-07-14 01:02:22 |
|
| 2023-03-29 01:07:57 |
|
| 2023-03-28 12:02:28 |
|
| 2023-02-13 09:29:25 |
|
| 2023-02-03 00:28:55 |
|
| 2022-10-11 12:06:16 |
|
| 2022-10-11 01:02:12 |
|
| 2021-05-04 12:06:40 |
|
| 2021-04-22 01:07:10 |
|
| 2020-05-24 01:04:02 |
|
| 2020-05-23 00:20:46 |
|
| 2018-10-16 00:19:20 |
|
| 2018-10-04 00:19:31 |
|
| 2017-11-21 12:02:00 |
|
| 2017-09-29 09:23:17 |
|
| 2017-07-29 12:02:40 |
|
| 2016-06-28 17:03:28 |
|
| 2016-04-26 16:48:26 |
|
| 2014-02-17 10:42:35 |
|
| 2013-05-11 10:42:14 |
|
