Vulnerability Description
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | >= 1.5, < 1.5.0.10 |
| Mozilla | Seamonkey | >= 1.0, < 1.0.8 |
| Debian | Debian Linux | 3.1 |
Related Weaknesses (CWE)
References
- ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.ascBroken Link
- ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.ascBroken Link
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230733ExploitIssue TrackingPatch
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Broken Link
- http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.htmlBroken Link
- http://secunia.com/advisories/24384Third Party Advisory
- http://secunia.com/advisories/24395Third Party Advisory
- http://secunia.com/advisories/24455Third Party Advisory
- http://secunia.com/advisories/24457Third Party Advisory
- http://secunia.com/advisories/24650Third Party Advisory
- http://secunia.com/advisories/25588Third Party Advisory
- http://securitytracker.com/id?1017726Third Party AdvisoryVDB Entry
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackwareMailing ListThird Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackwareMailing ListThird Party Advisory
- http://www.debian.org/security/2007/dsa-1336Third Party Advisory
FAQ
What is CVE-2007-0994?
CVE-2007-0994 is a vulnerability with a CVSS score of 6.8 (MEDIUM). A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the us...
How severe is CVE-2007-0994?
CVE-2007-0994 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-0994?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Debian Debian Linux.