CVE-2007-3845 Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with....
HighCVSS 9.3
EPSS 5.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | = 2.0.0.5 | No fix listed |
| mozilla seamonkey | = 1.1.3 | No fix listed |
| mozilla Thunderbird | = 2.0.0.5 | No fix listed |
References
- bugzilla.mozilla.org
- HPSBUX02153 vendor-advisory
- HPSBUX02156 vendor-advisory
- 26234 third-party-advisory
- 26258 third-party-advisory
- 26303 third-party-advisory
- 26309 third-party-advisory
- 26331 third-party-advisory
- 26335 third-party-advisory
- 26393 third-party-advisory
- 26572 third-party-advisory
- 27326 third-party-advisory
- 27414 third-party-advisory
- 28135 third-party-advisory
- SSA:2007-213-01 vendor-advisory
- 103177 vendor-advisory
- 201516 vendor-advisory
- DSA-1344 vendor-advisory
- DSA-1345 vendor-advisory
- DSA-1346 vendor-advisory
- DSA-1391 vendor-advisory
- MDKSA-2007:152 vendor-advisory
- MDVSA-2007:047 vendor-advisory
- MDVSA-2008:047 vendor-advisory
- www.mozilla.org
- 20070801 FLEA-2007-0039-1 firefox mailing-list
- 20070803 FLEA-2007-0040-1 thunderbird mailing-list
- 25053 vdb-entry
- USN-493-1 vendor-advisory
- USN-503-1 vendor-advisory
- ADV-2007-4256 vdb-entry
- ADV-2008-0082 vdb-entry
- bugzilla.mozilla.org
- issues.rpath.com