CVE-2007-4841 Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with...
HighCVSS 9.3
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid "%" encoding, related to improper file type handling on Windows XP with Internet Explorer 7 installed, a variant of CVE-2007-3845.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | <= 2.0.0.8 | No fix listed |
| mozilla seamonkey | <= 1.1.5 | No fix listed |
| mozilla Thunderbird | <= 2.0.0.8 | No fix listed |
References
- HPSBUX02153 vendor-advisory
- HPSBUX02156 vendor-advisory
- 27311 third-party-advisory vendor-advisory
- 27315 third-party-advisory vendor-advisory
- 27360 third-party-advisory vendor-advisory
- 27414 third-party-advisory vendor-advisory
- 27744 third-party-advisory vendor-advisory
- 28363 third-party-advisory vendor-advisory
- 28398 third-party-advisory vendor-advisory
- SSA:2007-324-01 vendor-advisory
- MDKSA-2007:202 vendor-advisory
- www.mozilla.org
- 25543 vdb-entry
- ADV-2007-3544 vdb-entry vendor-advisory
- ADV-2008-0082 vdb-entry vendor-advisory
- ADV-2008-0083 vdb-entry vendor-advisory
- xs-sniper.com