CVE-2007-0995

Published: Feb 26, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 ignores trailing invalid HTML characters in attribute names, which allows remote attackers to bypass content filters that use regular expressions.

Affected (4)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0
Mozilla Seamonkey	Up to 1.0.7

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (100)

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2713

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2728

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: secalert@redhat.com

http://ha.ckers.org/xss.html#XSS_Non_alpha_non_digit2

Source: secalert@redhat.com

http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html

Source: secalert@redhat.com

http://osvdb.org/32112

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2007-0077.html

Source: secalert@redhat.com

http://secunia.com/advisories/24205

Source: secalert@redhat.com

http://secunia.com/advisories/24238

Source: secalert@redhat.com

http://secunia.com/advisories/24287

Source: secalert@redhat.com

http://secunia.com/advisories/24290

Source: secalert@redhat.com

http://secunia.com/advisories/24293

Source: secalert@redhat.com

http://secunia.com/advisories/24320

Source: secalert@redhat.com

http://secunia.com/advisories/24328

Source: secalert@redhat.com

http://secunia.com/advisories/24333

Source: secalert@redhat.com

http://secunia.com/advisories/24342

Source: secalert@redhat.com

http://secunia.com/advisories/24343

Source: secalert@redhat.com

http://secunia.com/advisories/24384

Source: secalert@redhat.com

http://secunia.com/advisories/24393

Source: secalert@redhat.com

http://secunia.com/advisories/24395

Source: secalert@redhat.com

http://secunia.com/advisories/24437

Source: secalert@redhat.com

http://secunia.com/advisories/24455

Source: secalert@redhat.com

http://secunia.com/advisories/24457

Source: secalert@redhat.com

http://secunia.com/advisories/24650

Source: secalert@redhat.com

http://secunia.com/advisories/25588

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200703-04.xml

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851

Source: secalert@redhat.com

http://www.debian.org/security/2007/dsa-1336

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2007:050

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2007/mfsa2007-02.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.novell.com/linux/security/advisories/2007_22_mozilla.html

Source: secalert@redhat.com

http://www.osvdb.org/32111

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0078.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0079.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0097.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0108.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/461336/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/461809/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/22694

Source: secalert@redhat.com

http://www.securitytracker.com/id?1017702

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-428-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/0718

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0083

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1081

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1103

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10164

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)