CVE-2007-5947
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote…
Does this matter?
Lower severity and a low EPSS score (2.71%). Track it; it rarely justifies an emergency change on its own.
Description
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.71% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mozilla/firefox · mozilla/seamonkey
- Source
- cve@mitre.org
References
- http://browser.netscape.com/releasenotes/
- http://bugs.gentoo.org/show_bug.cgi?id=198965
- http://bugs.gentoo.org/show_bug.cgi?id=200909
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
- http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html
- http://secunia.com/advisories/27605Vendor Advisory
- http://secunia.com/advisories/27793Vendor Advisory
- http://secunia.com/advisories/27796Vendor Advisory
- http://secunia.com/advisories/27797Vendor Advisory
- http://secunia.com/advisories/27800Vendor Advisory
- http://secunia.com/advisories/27816Vendor Advisory
- http://secunia.com/advisories/27838Vendor Advisory
- http://secunia.com/advisories/27845Vendor Advisory
- http://secunia.com/advisories/27855Vendor Advisory
- http://secunia.com/advisories/27944Vendor Advisory
- http://secunia.com/advisories/27955Vendor Advisory
- http://secunia.com/advisories/27957Vendor Advisory
- http://secunia.com/advisories/27979Vendor Advisory
- http://secunia.com/advisories/28001Vendor Advisory
- http://secunia.com/advisories/28016Vendor Advisory
- http://secunia.com/advisories/28171Vendor Advisory
- http://secunia.com/advisories/28277Vendor Advisory
- http://secunia.com/advisories/28398Vendor Advisory
- http://secunia.com/advisories/29164
- http://security.gentoo.org/glsa/glsa-200712-21.xml
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1
- http://wiki.rpath.com/Advisories:rPSA-2008-0093
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.