CVE-2007-1084

Published: Feb 23, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page.

Affected (30)

Products: Mozilla: Firefox

1 product

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.1
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 2.0

Related CWEs

References (24)

http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0490.html

Source: cve@mitre.org

http://lcamtuf.coredump.cx/ffbook

Source: cve@mitre.org

http://lcamtuf.coredump.cx/ffbook/

Source: cve@mitre.org

http://osvdb.org/33803

Source: cve@mitre.org

http://securityreason.com/securityalert/2304

Source: cve@mitre.org

http://www.heise-security.co.uk/news/85728

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/460885/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/460890/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/460896/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/461021/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/22666

Source: cve@mitre.org

https://bugzilla.mozilla.org/show_bug.cgi?id=371179

Source: cve@mitre.org

http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0490.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lcamtuf.coredump.cx/ffbook

Source: af854a3a-2127-422b-91ae-364da2661108

http://lcamtuf.coredump.cx/ffbook/

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/33803

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/2304

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.heise-security.co.uk/news/85728

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/460885/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/460890/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/460896/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/461021/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/22666

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=371179

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.