Computer Security
[EN] no-pyccku

Mozilla Firefox / Thunderbird URL processing code execution
updated since 25.07.2007
SecurityVulns ID:7978
Threat Level:
Description:It's possible to inject shell characters into mailto:, news:, nntp: IRLs if Thunderbird is used as URL handler.
Affected:MOZILLA : Thunderbird 1.5
 MOZILLA : Firefox 2.0
 MOZILLA : Thunderbird 2.0
 ICEAPE : iceape 1.0
 XULRUNNER : xulrunner 1.8
 ICEAPE : iceape 1.1
CVE:CVE-2007-3845 (Mozilla Firefox before, Thunderbird before and 2.x before, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler.")
 CVE-2007-3844 (Mozilla Firefox, Thunderbird and before, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.)
Original documentdocumentMOZILLA, Mozilla Foundation Security Advisory 2007-27 (01.08.2007)
 documentMOZILLA, Mozilla Foundation Security Advisory 2007-26 (01.08.2007)
 documentThor Larholm, Re: [Full-disclosure] Mozilla protocol abuse (26.07.2007)
 documentThor Larholm, Mozilla protocol abuse (26.07.2007)
 documentBilly Rios, Remote Command Exec (FireFox et al) (25.07.2007)
 documentBilly Rios, [Full-disclosure] More URI Handling Vulnerabilites (FireFox Remote Command Execution) (25.07.2007)
Files:Mozilla protocol abuse report and the XPI exploits

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod