CVE-2007-0981

Published: Feb 16, 2007Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.

Affected (51)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

51 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 1.5.0.9
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc3
Mozilla Firefox	Version preview_release
Mozilla Seamonkey	Up to 1.0.7
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0

Related CWEs

CWE-264

References (114)

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc (unsafe URL)

Source: cve@mitre.org

http://fedoranews.org/cms/node/2713

Source: cve@mitre.org

http://fedoranews.org/cms/node/2728

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: cve@mitre.org

http://lcamtuf.dione.cc/ffhostname.html

Source: cve@mitre.org

Exploit

http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2007-0077.html

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24175

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24205

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24238

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24287

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24290

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24293

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24320

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24328

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24333

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24342

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24343

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24384

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24393

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24395

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24437

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24455

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24457

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24650

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/25588

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200703-04.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/2262

Source: cve@mitre.org

http://securitytracker.com/id?1017654

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1336

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/885753

Source: cve@mitre.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2007:050

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2007/mfsa2007-07.html

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2007_22_mozilla.html

Source: cve@mitre.org

http://www.osvdb.org/32104

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0078.html

Source: cve@mitre.org

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2007-0079.html

Source: cve@mitre.org

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2007-0097.html

Source: cve@mitre.org

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2007-0108.html

Source: cve@mitre.org

Vendor Advisory

http://www.securityfocus.com/archive/1/460126/100/200/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/460217/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/461336/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/461809/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/22566

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-428-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/0624

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/0718

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0083

Source: cve@mitre.org

https://bugzilla.mozilla.org/show_bug.cgi?id=370445

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/32533

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1081

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1103

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9730

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)