CVE-2007-0996

Published: Feb 27, 2007Modified: Apr 23, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.

Affected (28)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 beta

References (82)

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc (unsafe URL)

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2713

Source: secalert@redhat.com

http://fedoranews.org/cms/node/2728

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: secalert@redhat.com

http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html

Source: secalert@redhat.com

http://osvdb.org/33812

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2007-0077.html

Source: secalert@redhat.com

http://secunia.com/advisories/24205

Source: secalert@redhat.com

http://secunia.com/advisories/24287

Source: secalert@redhat.com

http://secunia.com/advisories/24290

Source: secalert@redhat.com

http://secunia.com/advisories/24320

Source: secalert@redhat.com

http://secunia.com/advisories/24328

Source: secalert@redhat.com

http://secunia.com/advisories/24333

Source: secalert@redhat.com

http://secunia.com/advisories/24342

Source: secalert@redhat.com

http://secunia.com/advisories/24343

Source: secalert@redhat.com

http://secunia.com/advisories/24384

Source: secalert@redhat.com

http://secunia.com/advisories/24395

Source: secalert@redhat.com

http://secunia.com/advisories/24455

Source: secalert@redhat.com

http://secunia.com/advisories/24457

Source: secalert@redhat.com

http://secunia.com/advisories/24650

Source: secalert@redhat.com

http://secunia.com/advisories/25588

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851

Source: secalert@redhat.com

http://www.debian.org/security/2007/dsa-1336

Source: secalert@redhat.com

http://www.hardened-php.net/advisory_032007.142.html

Source: secalert@redhat.com

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2007:050

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2007/mfsa2007-02.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.novell.com/linux/security/advisories/2007_22_mozilla.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0078.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0079.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0097.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0108.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/461076/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/461336/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/22694

Source: secalert@redhat.com

http://www.securitytracker.com/id?1017702

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-428-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/0718

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1103

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10086

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (unsafe URL)