CVE-2007-5960

Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.
References
Link Resource
http://browser.netscape.com/releasenotes/
http://bugs.gentoo.org/show_bug.cgi?id=198965
http://bugs.gentoo.org/show_bug.cgi?id=200909
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html
http://secunia.com/advisories/27725 Vendor Advisory
http://secunia.com/advisories/27793 Vendor Advisory
http://secunia.com/advisories/27796 Vendor Advisory
http://secunia.com/advisories/27797 Vendor Advisory
http://secunia.com/advisories/27800 Vendor Advisory
http://secunia.com/advisories/27816 Vendor Advisory
http://secunia.com/advisories/27838 Vendor Advisory
http://secunia.com/advisories/27845 Vendor Advisory
http://secunia.com/advisories/27855 Vendor Advisory
http://secunia.com/advisories/27944 Vendor Advisory
http://secunia.com/advisories/27955 Vendor Advisory
http://secunia.com/advisories/27957 Vendor Advisory
http://secunia.com/advisories/27979 Vendor Advisory
http://secunia.com/advisories/28001 Vendor Advisory
http://secunia.com/advisories/28016 Vendor Advisory
http://secunia.com/advisories/28171 Vendor Advisory
http://secunia.com/advisories/28277 Vendor Advisory
http://secunia.com/advisories/28398 Vendor Advisory
http://secunia.com/advisories/29164
http://security.gentoo.org/glsa/glsa-200712-21.xml
http://securitytracker.com/id?1018995
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1
http://wiki.rpath.com/Advisories:rPSA-2008-0093
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
http://www.debian.org/security/2007/dsa-1424
http://www.debian.org/security/2007/dsa-1425
http://www.mandriva.com/security/advisories?name=MDKSA-2007:246
http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
http://www.redhat.com/support/errata/RHSA-2007-1082.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1083.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1084.html Vendor Advisory
http://www.securityfocus.com/archive/1/488002/100/0/threaded
http://www.securityfocus.com/archive/1/488971/100/0/threaded
http://www.securityfocus.com/bid/26589
http://www.ubuntu.com/usn/usn-546-2
http://www.vupen.com/english/advisories/2007/4002
http://www.vupen.com/english/advisories/2007/4018
http://www.vupen.com/english/advisories/2008/0083
http://www.vupen.com/english/advisories/2008/0643
https://exchange.xforce.ibmcloud.com/vulnerabilities/38644
https://issues.rpath.com/browse/RPL-1984
https://issues.rpath.com/browse/RPL-1995
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794
https://usn.ubuntu.com/546-1/
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html
http://browser.netscape.com/releasenotes/
http://bugs.gentoo.org/show_bug.cgi?id=198965
http://bugs.gentoo.org/show_bug.cgi?id=200909
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html
http://secunia.com/advisories/27725 Vendor Advisory
http://secunia.com/advisories/27793 Vendor Advisory
http://secunia.com/advisories/27796 Vendor Advisory
http://secunia.com/advisories/27797 Vendor Advisory
http://secunia.com/advisories/27800 Vendor Advisory
http://secunia.com/advisories/27816 Vendor Advisory
http://secunia.com/advisories/27838 Vendor Advisory
http://secunia.com/advisories/27845 Vendor Advisory
http://secunia.com/advisories/27855 Vendor Advisory
http://secunia.com/advisories/27944 Vendor Advisory
http://secunia.com/advisories/27955 Vendor Advisory
http://secunia.com/advisories/27957 Vendor Advisory
http://secunia.com/advisories/27979 Vendor Advisory
http://secunia.com/advisories/28001 Vendor Advisory
http://secunia.com/advisories/28016 Vendor Advisory
http://secunia.com/advisories/28171 Vendor Advisory
http://secunia.com/advisories/28277 Vendor Advisory
http://secunia.com/advisories/28398 Vendor Advisory
http://secunia.com/advisories/29164
http://security.gentoo.org/glsa/glsa-200712-21.xml
http://securitytracker.com/id?1018995
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1
http://wiki.rpath.com/Advisories:rPSA-2008-0093
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
http://www.debian.org/security/2007/dsa-1424
http://www.debian.org/security/2007/dsa-1425
http://www.mandriva.com/security/advisories?name=MDKSA-2007:246
http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
http://www.redhat.com/support/errata/RHSA-2007-1082.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1083.html Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1084.html Vendor Advisory
http://www.securityfocus.com/archive/1/488002/100/0/threaded
http://www.securityfocus.com/archive/1/488971/100/0/threaded
http://www.securityfocus.com/bid/26589
http://www.ubuntu.com/usn/usn-546-2
http://www.vupen.com/english/advisories/2007/4002
http://www.vupen.com/english/advisories/2007/4018
http://www.vupen.com/english/advisories/2008/0083
http://www.vupen.com/english/advisories/2008/0643
https://exchange.xforce.ibmcloud.com/vulnerabilities/38644
https://issues.rpath.com/browse/RPL-1984
https://issues.rpath.com/browse/RPL-1995
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794
https://usn.ubuntu.com/546-1/
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*

History

21 Nov 2024, 00:39

Type Values Removed Values Added
References () http://browser.netscape.com/releasenotes/ - () http://browser.netscape.com/releasenotes/ -
References () http://bugs.gentoo.org/show_bug.cgi?id=198965 - () http://bugs.gentoo.org/show_bug.cgi?id=198965 -
References () http://bugs.gentoo.org/show_bug.cgi?id=200909 - () http://bugs.gentoo.org/show_bug.cgi?id=200909 -
References () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 - () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 -
References () http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html - () http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html -
References () http://secunia.com/advisories/27725 - Vendor Advisory () http://secunia.com/advisories/27725 - Vendor Advisory
References () http://secunia.com/advisories/27793 - Vendor Advisory () http://secunia.com/advisories/27793 - Vendor Advisory
References () http://secunia.com/advisories/27796 - Vendor Advisory () http://secunia.com/advisories/27796 - Vendor Advisory
References () http://secunia.com/advisories/27797 - Vendor Advisory () http://secunia.com/advisories/27797 - Vendor Advisory
References () http://secunia.com/advisories/27800 - Vendor Advisory () http://secunia.com/advisories/27800 - Vendor Advisory
References () http://secunia.com/advisories/27816 - Vendor Advisory () http://secunia.com/advisories/27816 - Vendor Advisory
References () http://secunia.com/advisories/27838 - Vendor Advisory () http://secunia.com/advisories/27838 - Vendor Advisory
References () http://secunia.com/advisories/27845 - Vendor Advisory () http://secunia.com/advisories/27845 - Vendor Advisory
References () http://secunia.com/advisories/27855 - Vendor Advisory () http://secunia.com/advisories/27855 - Vendor Advisory
References () http://secunia.com/advisories/27944 - Vendor Advisory () http://secunia.com/advisories/27944 - Vendor Advisory
References () http://secunia.com/advisories/27955 - Vendor Advisory () http://secunia.com/advisories/27955 - Vendor Advisory
References () http://secunia.com/advisories/27957 - Vendor Advisory () http://secunia.com/advisories/27957 - Vendor Advisory
References () http://secunia.com/advisories/27979 - Vendor Advisory () http://secunia.com/advisories/27979 - Vendor Advisory
References () http://secunia.com/advisories/28001 - Vendor Advisory () http://secunia.com/advisories/28001 - Vendor Advisory
References () http://secunia.com/advisories/28016 - Vendor Advisory () http://secunia.com/advisories/28016 - Vendor Advisory
References () http://secunia.com/advisories/28171 - Vendor Advisory () http://secunia.com/advisories/28171 - Vendor Advisory
References () http://secunia.com/advisories/28277 - Vendor Advisory () http://secunia.com/advisories/28277 - Vendor Advisory
References () http://secunia.com/advisories/28398 - Vendor Advisory () http://secunia.com/advisories/28398 - Vendor Advisory
References () http://secunia.com/advisories/29164 - () http://secunia.com/advisories/29164 -
References () http://security.gentoo.org/glsa/glsa-200712-21.xml - () http://security.gentoo.org/glsa/glsa-200712-21.xml -
References () http://securitytracker.com/id?1018995 - () http://securitytracker.com/id?1018995 -
References () http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006 - () http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006 -
References () http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833 - () http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833 -
References () http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1 - () http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1 -
References () http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1 - () http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1 -
References () http://wiki.rpath.com/Advisories:rPSA-2008-0093 - () http://wiki.rpath.com/Advisories:rPSA-2008-0093 -
References () http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260 - () http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260 -
References () http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093 - () http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093 -
References () http://www.debian.org/security/2007/dsa-1424 - () http://www.debian.org/security/2007/dsa-1424 -
References () http://www.debian.org/security/2007/dsa-1425 - () http://www.debian.org/security/2007/dsa-1425 -
References () http://www.mandriva.com/security/advisories?name=MDKSA-2007:246 - () http://www.mandriva.com/security/advisories?name=MDKSA-2007:246 -
References () http://www.mozilla.org/security/announce/2007/mfsa2007-39.html - () http://www.mozilla.org/security/announce/2007/mfsa2007-39.html -
References () http://www.redhat.com/support/errata/RHSA-2007-1082.html - Vendor Advisory () http://www.redhat.com/support/errata/RHSA-2007-1082.html - Vendor Advisory
References () http://www.redhat.com/support/errata/RHSA-2007-1083.html - Vendor Advisory () http://www.redhat.com/support/errata/RHSA-2007-1083.html - Vendor Advisory
References () http://www.redhat.com/support/errata/RHSA-2007-1084.html - Vendor Advisory () http://www.redhat.com/support/errata/RHSA-2007-1084.html - Vendor Advisory
References () http://www.securityfocus.com/archive/1/488002/100/0/threaded - () http://www.securityfocus.com/archive/1/488002/100/0/threaded -
References () http://www.securityfocus.com/archive/1/488971/100/0/threaded - () http://www.securityfocus.com/archive/1/488971/100/0/threaded -
References () http://www.securityfocus.com/bid/26589 - () http://www.securityfocus.com/bid/26589 -
References () http://www.ubuntu.com/usn/usn-546-2 - () http://www.ubuntu.com/usn/usn-546-2 -
References () http://www.vupen.com/english/advisories/2007/4002 - () http://www.vupen.com/english/advisories/2007/4002 -
References () http://www.vupen.com/english/advisories/2007/4018 - () http://www.vupen.com/english/advisories/2007/4018 -
References () http://www.vupen.com/english/advisories/2008/0083 - () http://www.vupen.com/english/advisories/2008/0083 -
References () http://www.vupen.com/english/advisories/2008/0643 - () http://www.vupen.com/english/advisories/2008/0643 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/38644 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/38644 -
References () https://issues.rpath.com/browse/RPL-1984 - () https://issues.rpath.com/browse/RPL-1984 -
References () https://issues.rpath.com/browse/RPL-1995 - () https://issues.rpath.com/browse/RPL-1995 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794 -
References () https://usn.ubuntu.com/546-1/ - () https://usn.ubuntu.com/546-1/ -
References () https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html - () https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html -
References () https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html - () https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html -
References () https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html - () https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html -
References () https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html - () https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html -

Information

Published : 2007-11-26 23:46

Updated : 2024-11-21 00:39


NVD link : CVE-2007-5960

Mitre link : CVE-2007-5960

CVE.ORG link : CVE-2007-5960


JSON object : View

Products Affected

mozilla

  • firefox
  • seamonkey
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')