CVE-2007-3285

Published: Jun 20, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would.

Affected (44)

Products: Mozilla: Firefox

1 product

Configuration A

44 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.4
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

References (44)

ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt (unsafe URL)

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: secalert@redhat.com

http://osvdb.org/38032

Source: secalert@redhat.com

http://secunia.com/advisories/26072

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26149

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26204

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26216

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26258

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/26271

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28135

Source: secalert@redhat.com

Vendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

Source: secalert@redhat.com

http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Source: secalert@redhat.com

http://www.0x000000.com/?i=333

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2007/mfsa2007-22.html

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/24447

Source: secalert@redhat.com

Exploit

http://www.securitytracker.com/id?1018413

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-490-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/4256

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=383478

Source: secalert@redhat.com

ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/38032

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/26072

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/26149

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/26204

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/26216

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/26258

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/26271

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/28135

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.0x000000.com/?i=333

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2007/mfsa2007-22.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/24447

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securitytracker.com/id?1018413

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/usn-490-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2007/4256

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=383478

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.