CVE-2007-0780

Published: Feb 26, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

browser.js in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 uses the requesting URI to identify child windows, which allows remote attackers to conduct cross-site scripting (XSS) attacks by opening a blocked popup originating from a javascript: URI in combination with multiple frames having the same data: URI.

Affected (6)

Products: Mozilla: Firefox, Seamonkey · Canonical: Ubuntu Linux

2 products

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	From 1.5 to 1.5.0.10
Mozilla Firefox	From 2.0 to 2.0.0.2
Mozilla Seamonkey	Before 1.0.8

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 5.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 6.10

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (94)

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)

Source: secalert@redhat.com

Broken Link

ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc (unsafe URL)

Source: secalert@redhat.com

Broken Link

http://fedoranews.org/cms/node/2713

Source: secalert@redhat.com

Broken Link

http://fedoranews.org/cms/node/2728

Source: secalert@redhat.com

Broken Link

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: secalert@redhat.com

Broken Link

http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html

Source: secalert@redhat.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2007-0077.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24205

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24238

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24287

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24290

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24293

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24320

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24328

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24333

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24342

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24343

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24384

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24393

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24395

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24437

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24455

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24457

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/24650

Source: secalert@redhat.com

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200703-04.xml

Source: secalert@redhat.com

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2007:050

Source: secalert@redhat.com

Third Party Advisory

http://www.mozilla.org/security/announce/2007/mfsa2007-05.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.novell.com/linux/security/advisories/2007_22_mozilla.html

Source: secalert@redhat.com

Broken Link

http://www.osvdb.org/32107

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2007-0078.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2007-0079.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2007-0097.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2007-0108.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/461336/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/461809/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/22694

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1017702

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-428-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2007/0718

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=354973

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/32667

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://issues.rpath.com/browse/RPL-1081

Source: secalert@redhat.com

Broken Link

https://issues.rpath.com/browse/RPL-1103

Source: secalert@redhat.com

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9884

Source: secalert@redhat.com

Third Party Advisory

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)