Lucene search

Mozilla FoundationMFSA2007-09

HistoryMar 05, 2007 - 12:00 a.m.

Privilege escalation by setting img.src to javascript: URI — Mozilla

2007-03-0500:00:00

Mozilla Foundation

www.mozilla.org

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.031 Low

EPSS

Percentile

90.9%

JSON

moz_bug_r_a4 reports that the fix for MFSA 2006-72 in Firefox 1.5.0.9 and Firefox 2.0.0.1 introduced a regression that allows scripts from web content to execute arbitrary code by setting the src attribute of an IMG tag to a specially crafted javascript: URI.

CPENameOperatorVersion
firefoxlt1.5.0.10
firefoxlt2.0.0.2
seamonkeylt1.0.8
seamonkeylt1.1.1

Name	Operator	Version
firefox	lt	1.5.0.10
firefox	lt	2.0.0.2
seamonkey	lt	1.0.8
seamonkey	lt	1.1.1

References

nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0994

www.mozilla.org/security/announce/2006/mfsa2006-72.html

bugzilla.mozilla.org/show_bug.cgi?id=368655

bugzilla.mozilla.org/show_bug.cgi?id=368763

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.031 Low

EPSS

Percentile

90.9%

JSON

Related for MFSA2007-09