Executive Summary
| Summary | |
|---|---|
| Title | Firefox vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-493-1 | First vendor Publication | 2007-07-31 |
| Vendor | Ubuntu | Last vendor Modification | 2007-07-31 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.10 Ubuntu 7.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 6.10: Ubuntu 7.04: After a standard system upgrade you need to restart Firefox to effect the necessary changes. Details follow: A flaw was discovered in handling of "about:blank" windows used by addons. A malicious web site could exploit this to modify the contents, or steal confidential data (such as passwords), of other web pages. (CVE-2007-3844) Jesper Johansson discovered that spaces and double-quotes were not correctly handled when launching external programs. In rare configurations, after tricking a user into opening a malicious web page, an attacker could execute helpers with arbitrary arguments with the user's privileges. (CVE-2007-3845) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-493-1 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:17637 | |||
| Oval ID: | oval:org.mitre.oval:def:17637 | ||
| Title: | USN-503-1 -- mozilla-thunderbird vulnerabilities | ||
| Description: | Various flaws were discovered in the layout and JavaScript engines. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-503-1 CVE-2007-3734 CVE-2007-3735 CVE-2007-3844 CVE-2007-3670 CVE-2007-3845 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 | Product(s): | mozilla-thunderbird |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18682 | |||
| Oval ID: | oval:org.mitre.oval:def:18682 | ||
| Title: | DSA-1346-1 iceape | ||
| Description: | Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the Seamonkey Internet Suite. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1346-1 CVE-2007-3844 CVE-2007-3845 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | iceape |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:18825 | |||
| Oval ID: | oval:org.mitre.oval:def:18825 | ||
| Title: | DSA-1344-1 iceweasel | ||
| Description: | Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1344-1 CVE-2007-3844 CVE-2007-3845 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | iceweasel |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:20237 | |||
| Oval ID: | oval:org.mitre.oval:def:20237 | ||
| Title: | DSA-1345-1 xulrunner | ||
| Description: | Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1345-1 CVE-2007-3844 CVE-2007-3845 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | xulrunner |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9493 | |||
| Oval ID: | oval:org.mitre.oval:def:9493 | ||
| Title: | Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression. | ||
| Description: | Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-3844 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 1 | |
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for Mozilla File : nvt/sles9p5018527.nasl |
| 2009-05-05 | Name : HP-UX Update for Thunderbird HPSBUX02156 File : nvt/gb_hp_ux_HPSBUX02156.nasl |
| 2009-04-09 | Name : Mandriva Update for mozilla-thunderbird MDVSA-2007:047 (mozilla-thunderbird) File : nvt/gb_mandriva_MDVSA_2007_047.nasl |
| 2009-04-09 | Name : Mandriva Update for mozilla-firefox MDKSA-2007:152 (mozilla-firefox) File : nvt/gb_mandriva_MDKSA_2007_152.nasl |
| 2009-03-23 | Name : Ubuntu Update for mozilla-thunderbird vulnerabilities USN-503-1 File : nvt/gb_ubuntu_USN_503_1.nasl |
| 2009-03-23 | Name : Ubuntu Update for firefox vulnerabilities USN-493-1 File : nvt/gb_ubuntu_USN_493_1.nasl |
| 2009-02-27 | Name : Fedora Update for thunderbird FEDORA-2007-3431 File : nvt/gb_fedora_2007_3431_thunderbird_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for thunderbird FEDORA-2007-3414 File : nvt/gb_fedora_2007_3414_thunderbird_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for seamonkey FEDORA-2007-2795 File : nvt/gb_fedora_2007_2795_seamonkey_fc8.nasl |
| 2009-02-27 | Name : Fedora Update for seamonkey FEDORA-2007-2601 File : nvt/gb_fedora_2007_2601_seamonkey_fc7.nasl |
| 2009-01-28 | Name : SuSE Update for MozillaFirefox,mozilla,seamonkey SUSE-SA:2007:057 File : nvt/gb_suse_2007_057.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200708-09 (mozilla/thunderbird/firefox/xulrunner) File : nvt/glsa_200708_09.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1344-1 (iceweasel) File : nvt/deb_1344_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1391-1 (icedove) File : nvt/deb_1391_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1346-1 (iceape) File : nvt/deb_1346_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1345-1 (xulrunner) File : nvt/deb_1345_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2007-213-01 firefox File : nvt/esoft_slk_ssa_2007_213_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 38031 | Mozilla Multiple Products Crafted URI Unspecified File Handling Arbitrary Co... |
| 38026 | Mozilla Multiple Products Addon Chrome Cross-Context Scripting |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2015-01-20 | Multiple product mailto uri handling code execution attempt RuleID : 32871 - Revision : 2 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 18173 - Revision : 7 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 18172 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 18171 - Revision : 8 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product snews uri handling code execution attempt RuleID : 15684 - Revision : 10 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product mailto uri handling code execution attempt RuleID : 13272 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product telnet uri handling code execution attempt RuleID : 13271 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product news uri handling code execution attempt RuleID : 13270 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Multiple product nntp uri handling code execution attempt RuleID : 13269 - Revision : 12 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0980.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0979.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0981.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20071019_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071019_seamonkey_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071019_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-047.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_MozillaFirefox-4570.nasl - Type : ACT_GATHER_INFO |
| 2007-11-16 | Name : The remote Fedora host is missing a security update. File : fedora_2007-3414.nasl - Type : ACT_GATHER_INFO |
| 2007-11-16 | Name : The remote Fedora host is missing a security update. File : fedora_2007-3431.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-493-1.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-503-1.nasl - Type : ACT_GATHER_INFO |
| 2007-11-07 | Name : The remote Fedora host is missing a security update. File : fedora_2007-2795.nasl - Type : ACT_GATHER_INFO |
| 2007-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2007-2601.nasl - Type : ACT_GATHER_INFO |
| 2007-10-26 | Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-4596.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0979.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0981.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0980.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-4594.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0979.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_e24797af803d11dcb787003048705d5a.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1391.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0981.nasl - Type : ACT_GATHER_INFO |
| 2007-10-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0980.nasl - Type : ACT_GATHER_INFO |
| 2007-10-24 | Name : The remote openSUSE host is missing a security update. File : suse_MozillaFirefox-4572.nasl - Type : ACT_GATHER_INFO |
| 2007-10-24 | Name : The remote openSUSE host is missing a security update. File : suse_MozillaFirefox-4574.nasl - Type : ACT_GATHER_INFO |
| 2007-08-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200708-09.nasl - Type : ACT_GATHER_INFO |
| 2007-08-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1346.nasl - Type : ACT_GATHER_INFO |
| 2007-08-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1345.nasl - Type : ACT_GATHER_INFO |
| 2007-08-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1344.nasl - Type : ACT_GATHER_INFO |
| 2007-08-04 | Name : A web browser on the remote host is prone to multiple flaws. File : seamonkey_114.nasl - Type : ACT_GATHER_INFO |
| 2007-08-02 | Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_2006.nasl - Type : ACT_GATHER_INFO |
| 2007-08-02 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-152.nasl - Type : ACT_GATHER_INFO |
| 2007-08-02 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-213-01.nasl - Type : ACT_GATHER_INFO |
| 2007-07-31 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_2006.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:04:31 |
|
