CVE-2007-5947

Published: Nov 14, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.

Affected (15)

Products: Mozilla: Firefox, Seamonkey

Mozilla

2 products

Firefox

Seamonkey

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 2.0.0.9
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Seamonkey	Up to 1.1.6
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (122)

http://browser.netscape.com/releasenotes/

Source: cve@mitre.org

http://bugs.gentoo.org/show_bug.cgi?id=198965

Source: cve@mitre.org

http://bugs.gentoo.org/show_bug.cgi?id=200909

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html

Source: cve@mitre.org

http://secunia.com/advisories/27605

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27793

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27796

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27797

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27800

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27816

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27838

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27845

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27855

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27944

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27955

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27957

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27979

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28001

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28016

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28171

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28277

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28398

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29164

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200712-21.xml

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1

Source: cve@mitre.org

http://wiki.rpath.com/Advisories:rPSA-2008-0093

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1424

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1425

Source: cve@mitre.org

http://www.gnucitizen.org/blog/web-mayhem-firefoxs-jar-protocol-issues

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/715737

Source: cve@mitre.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2007:246

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2007/mfsa2007-37.html

Source: cve@mitre.org

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2007-1082.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-1083.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-1084.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/488002/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/488971/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/26385

Source: cve@mitre.org

http://www.securitytracker.com/id?1018928

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-546-2

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/3818

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4002

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4018

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0083

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0643

Source: cve@mitre.org

https://bugzilla.mozilla.org/show_bug.cgi?id=369814

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/38356

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1984

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1995

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9873

Source: cve@mitre.org

https://usn.ubuntu.com/546-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html

Source: cve@mitre.org

http://browser.netscape.com/releasenotes/