CVE-2007-4879

Published: Sep 13, 2007Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains.

Affected (88)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

65 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.12
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.4.1
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0

Configuration B

23 vulnerable

Vulnerable Software	Affected Versions
Mozilla Seamonkey	Up to 1.1.8
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta

References (56)

http://0x90.eu/ff_tls_poc.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html

Source: secalert@redhat.com

http://secunia.com/advisories/29526

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29539

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29541

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29547

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29558

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29560

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29616

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/29645

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/30327

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/30620

Source: secalert@redhat.com

Vendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1

Source: secalert@redhat.com

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1532

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1534

Source: secalert@redhat.com

http://www.debian.org/security/2008/dsa-1535

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:080

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2008/mfsa2008-17.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/490196/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/28448

Source: secalert@redhat.com

http://www.securitytracker.com/id?1019704

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-592-1

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA08-087A.html

Source: secalert@redhat.com

US Government Resource

http://www.vupen.com/english/advisories/2008/0998/references

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2008/1793/references

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=395399

Source: secalert@redhat.com

http://0x90.eu/ff_tls_poc.html