CVE-2007-3089

Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code that intercepts keystroke values from window.event, aka the "promiscuous IFRAME access bug," a related issue to CVE-2006-4568.
References
Link Resource
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt
ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://lcamtuf.coredump.cx/ifsnatch/
http://osvdb.org/38024
http://secunia.com/advisories/25589 Vendor Advisory
http://secunia.com/advisories/26072 Vendor Advisory
http://secunia.com/advisories/26095 Vendor Advisory
http://secunia.com/advisories/26103 Vendor Advisory
http://secunia.com/advisories/26106 Vendor Advisory
http://secunia.com/advisories/26107 Vendor Advisory
http://secunia.com/advisories/26149 Vendor Advisory
http://secunia.com/advisories/26151 Vendor Advisory
http://secunia.com/advisories/26159 Vendor Advisory
http://secunia.com/advisories/26179 Vendor Advisory
http://secunia.com/advisories/26204 Vendor Advisory
http://secunia.com/advisories/26205 Vendor Advisory
http://secunia.com/advisories/26211 Vendor Advisory
http://secunia.com/advisories/26216 Vendor Advisory
http://secunia.com/advisories/26258 Vendor Advisory
http://secunia.com/advisories/26271 Vendor Advisory
http://secunia.com/advisories/26460 Vendor Advisory
http://secunia.com/advisories/28135 Vendor Advisory
http://securityreason.com/securityalert/2781
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html
http://www.debian.org/security/2007/dsa-1337
http://www.debian.org/security/2007/dsa-1338
http://www.debian.org/security/2007/dsa-1339
http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml
http://www.kb.cert.org/vuls/id/143297 US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2007:152
http://www.mozilla.org/security/announce/2007/mfsa2007-20.html
http://www.novell.com/linux/security/advisories/2007_49_mozilla.html
http://www.redhat.com/support/errata/RHSA-2007-0722.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-0723.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-0724.html Vendor Advisory
http://www.securityfocus.com/archive/1/470446/100/0/threaded
http://www.securityfocus.com/archive/1/474226/100/0/threaded
http://www.securityfocus.com/archive/1/474542/100/0/threaded
http://www.securityfocus.com/bid/24286
http://www.securitytracker.com/id?1018412
http://www.ubuntu.com/usn/usn-490-1
http://www.us-cert.gov/cas/techalerts/TA07-199A.html US Government Resource
http://www.vupen.com/english/advisories/2007/2564
http://www.vupen.com/english/advisories/2007/4256
https://bugzilla.mozilla.org/show_bug.cgi?id=381300
https://bugzilla.mozilla.org/show_bug.cgi?id=381300
https://bugzilla.mozilla.org/show_bug.cgi?id=382686
https://bugzilla.mozilla.org/show_bug.cgi?id=382686
https://exchange.xforce.ibmcloud.com/vulnerabilities/34701
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11122
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt
ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc
http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://lcamtuf.coredump.cx/ifsnatch/
http://osvdb.org/38024
http://secunia.com/advisories/25589 Vendor Advisory
http://secunia.com/advisories/26072 Vendor Advisory
http://secunia.com/advisories/26095 Vendor Advisory
http://secunia.com/advisories/26103 Vendor Advisory
http://secunia.com/advisories/26106 Vendor Advisory
http://secunia.com/advisories/26107 Vendor Advisory
http://secunia.com/advisories/26149 Vendor Advisory
http://secunia.com/advisories/26151 Vendor Advisory
http://secunia.com/advisories/26159 Vendor Advisory
http://secunia.com/advisories/26179 Vendor Advisory
http://secunia.com/advisories/26204 Vendor Advisory
http://secunia.com/advisories/26205 Vendor Advisory
http://secunia.com/advisories/26211 Vendor Advisory
http://secunia.com/advisories/26216 Vendor Advisory
http://secunia.com/advisories/26258 Vendor Advisory
http://secunia.com/advisories/26271 Vendor Advisory
http://secunia.com/advisories/26460 Vendor Advisory
http://secunia.com/advisories/28135 Vendor Advisory
http://securityreason.com/securityalert/2781
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html
http://www.debian.org/security/2007/dsa-1337
http://www.debian.org/security/2007/dsa-1338
http://www.debian.org/security/2007/dsa-1339
http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml
http://www.kb.cert.org/vuls/id/143297 US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2007:152
http://www.mozilla.org/security/announce/2007/mfsa2007-20.html
http://www.novell.com/linux/security/advisories/2007_49_mozilla.html
http://www.redhat.com/support/errata/RHSA-2007-0722.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-0723.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-0724.html Vendor Advisory
http://www.securityfocus.com/archive/1/470446/100/0/threaded
http://www.securityfocus.com/archive/1/474226/100/0/threaded
http://www.securityfocus.com/archive/1/474542/100/0/threaded
http://www.securityfocus.com/bid/24286
http://www.securitytracker.com/id?1018412
http://www.ubuntu.com/usn/usn-490-1
http://www.us-cert.gov/cas/techalerts/TA07-199A.html US Government Resource
http://www.vupen.com/english/advisories/2007/2564
http://www.vupen.com/english/advisories/2007/4256
https://bugzilla.mozilla.org/show_bug.cgi?id=381300
https://bugzilla.mozilla.org/show_bug.cgi?id=381300
https://bugzilla.mozilla.org/show_bug.cgi?id=382686
https://bugzilla.mozilla.org/show_bug.cgi?id=382686
https://exchange.xforce.ibmcloud.com/vulnerabilities/34701
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11122
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*

History

21 Nov 2024, 00:32

Type Values Removed Values Added
References () ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt - () ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt -
References () ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc - () ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc -
References () http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html - () http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html -
References () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 - () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 -
References () http://lcamtuf.coredump.cx/ifsnatch/ - () http://lcamtuf.coredump.cx/ifsnatch/ -
References () http://osvdb.org/38024 - () http://osvdb.org/38024 -
References () http://secunia.com/advisories/25589 - Vendor Advisory () http://secunia.com/advisories/25589 - Vendor Advisory
References () http://secunia.com/advisories/26072 - Vendor Advisory () http://secunia.com/advisories/26072 - Vendor Advisory
References () http://secunia.com/advisories/26095 - Vendor Advisory () http://secunia.com/advisories/26095 - Vendor Advisory
References () http://secunia.com/advisories/26103 - Vendor Advisory () http://secunia.com/advisories/26103 - Vendor Advisory
References () http://secunia.com/advisories/26106 - Vendor Advisory () http://secunia.com/advisories/26106 - Vendor Advisory
References () http://secunia.com/advisories/26107 - Vendor Advisory () http://secunia.com/advisories/26107 - Vendor Advisory
References () http://secunia.com/advisories/26149 - Vendor Advisory () http://secunia.com/advisories/26149 - Vendor Advisory
References () http://secunia.com/advisories/26151 - Vendor Advisory () http://secunia.com/advisories/26151 - Vendor Advisory
References () http://secunia.com/advisories/26159 - Vendor Advisory () http://secunia.com/advisories/26159 - Vendor Advisory
References () http://secunia.com/advisories/26179 - Vendor Advisory () http://secunia.com/advisories/26179 - Vendor Advisory
References () http://secunia.com/advisories/26204 - Vendor Advisory () http://secunia.com/advisories/26204 - Vendor Advisory
References () http://secunia.com/advisories/26205 - Vendor Advisory () http://secunia.com/advisories/26205 - Vendor Advisory
References () http://secunia.com/advisories/26211 - Vendor Advisory () http://secunia.com/advisories/26211 - Vendor Advisory
References () http://secunia.com/advisories/26216 - Vendor Advisory () http://secunia.com/advisories/26216 - Vendor Advisory
References () http://secunia.com/advisories/26258 - Vendor Advisory () http://secunia.com/advisories/26258 - Vendor Advisory
References () http://secunia.com/advisories/26271 - Vendor Advisory () http://secunia.com/advisories/26271 - Vendor Advisory
References () http://secunia.com/advisories/26460 - Vendor Advisory () http://secunia.com/advisories/26460 - Vendor Advisory
References () http://secunia.com/advisories/28135 - Vendor Advisory () http://secunia.com/advisories/28135 - Vendor Advisory
References () http://securityreason.com/securityalert/2781 - () http://securityreason.com/securityalert/2781 -
References () http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1 - () http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1 -
References () http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1 - () http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1 -
References () http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html - () http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html -
References () http://www.debian.org/security/2007/dsa-1337 - () http://www.debian.org/security/2007/dsa-1337 -
References () http://www.debian.org/security/2007/dsa-1338 - () http://www.debian.org/security/2007/dsa-1338 -
References () http://www.debian.org/security/2007/dsa-1339 - () http://www.debian.org/security/2007/dsa-1339 -
References () http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml - () http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml -
References () http://www.kb.cert.org/vuls/id/143297 - US Government Resource () http://www.kb.cert.org/vuls/id/143297 - US Government Resource
References () http://www.mandriva.com/security/advisories?name=MDKSA-2007:152 - () http://www.mandriva.com/security/advisories?name=MDKSA-2007:152 -
References () http://www.mozilla.org/security/announce/2007/mfsa2007-20.html - () http://www.mozilla.org/security/announce/2007/mfsa2007-20.html -
References () http://www.novell.com/linux/security/advisories/2007_49_mozilla.html - () http://www.novell.com/linux/security/advisories/2007_49_mozilla.html -
References () http://www.redhat.com/support/errata/RHSA-2007-0722.html - Vendor Advisory () http://www.redhat.com/support/errata/RHSA-2007-0722.html - Vendor Advisory
References () http://www.redhat.com/support/errata/RHSA-2007-0723.html - Vendor Advisory () http://www.redhat.com/support/errata/RHSA-2007-0723.html - Vendor Advisory
References () http://www.redhat.com/support/errata/RHSA-2007-0724.html - Vendor Advisory () http://www.redhat.com/support/errata/RHSA-2007-0724.html - Vendor Advisory
References () http://www.securityfocus.com/archive/1/470446/100/0/threaded - () http://www.securityfocus.com/archive/1/470446/100/0/threaded -
References () http://www.securityfocus.com/archive/1/474226/100/0/threaded - () http://www.securityfocus.com/archive/1/474226/100/0/threaded -
References () http://www.securityfocus.com/archive/1/474542/100/0/threaded - () http://www.securityfocus.com/archive/1/474542/100/0/threaded -
References () http://www.securityfocus.com/bid/24286 - () http://www.securityfocus.com/bid/24286 -
References () http://www.securitytracker.com/id?1018412 - () http://www.securitytracker.com/id?1018412 -
References () http://www.ubuntu.com/usn/usn-490-1 - () http://www.ubuntu.com/usn/usn-490-1 -
References () http://www.us-cert.gov/cas/techalerts/TA07-199A.html - US Government Resource () http://www.us-cert.gov/cas/techalerts/TA07-199A.html - US Government Resource
References () http://www.vupen.com/english/advisories/2007/2564 - () http://www.vupen.com/english/advisories/2007/2564 -
References () http://www.vupen.com/english/advisories/2007/4256 - () http://www.vupen.com/english/advisories/2007/4256 -
References () https://bugzilla.mozilla.org/show_bug.cgi?id=381300 - () https://bugzilla.mozilla.org/show_bug.cgi?id=381300 -
References () https://bugzilla.mozilla.org/show_bug.cgi?id=382686 - () https://bugzilla.mozilla.org/show_bug.cgi?id=382686 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/34701 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/34701 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11122 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11122 -

Information

Published : 2007-06-06 21:30

Updated : 2024-11-21 00:32


NVD link : CVE-2007-3089

Mitre link : CVE-2007-3089

CVE.ORG link : CVE-2007-3089


JSON object : View

Products Affected

mozilla

  • firefox