CVE-2007-0994
published 2007-03-06CVE-2007-0994: A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers…
PriorityP426medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
3.21%
86.7th percentile
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| mozilla | firefox | >= 1.5 < 1.5.0.10 | 1.5.0.10 |
| mozilla | firefox | >= 2.0 < 2.0.0.2 | 2.0.0.2 |
| mozilla | seamonkey | >= 1.0 < 1.0.8 | 1.0.8 |
| mozilla | seamonkey | >= 1.1 < 1.1.1 | 1.1.1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qp4j-3v3v-gvgq: A regression error in Mozilla Firefox 2
ghsa_unreviewed·2022-05-03
CVE-2007-0994 [MEDIUM] CWE-94 GHSA-qp4j-3v3v-gvgq: A regression error in Mozilla Firefox 2
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.
Red Hat
security flaw
vendor_redhat·2007-03-05·CVSS 6.8
CVE-2007-0994 [MEDIUM] security flaw
security flaw
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-0994 security flaw
bugzilla·2018-08-16·CVSS 6.8
CVE-2007-0994 [MEDIUM] CVE-2007-0994 security flaw
CVE-2007-0994 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.
Bugzilla
CVE-2007-0994 Thunderbird arbitrary javascript command execution
bugzilla·2007-03-02·CVSS 6.8
CVE-2007-0994 [MEDIUM] CVE-2007-0994 Thunderbird arbitrary javascript command execution
CVE-2007-0994 Thunderbird arbitrary javascript command execution
A bug was found in the way Thunderbird handles tags. To quote the
upstream bug:
When javascript: url is set by script, the access checks work properly.
i.src = "javascript:...";
But, when javascript: url is set by (or , ) tag, the access
checks don't work properly.
Thus, sandboxed script can access xbl.method's clone parent and xbl compilation
scope to run arbitrary code with chrome privileges.
Discussion:
Lifting embargo
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
Bugzilla
CVE-2007-0775 Multiple Firefox flaws (CVE-2007-0777, CVE-2007-0994, CVE-2007-0995, CVE-2007-0996, CVE-2006-6077, CVE-2007-0778, CVE-2007-0779, CVE-2007-0780, CVE-2007-0800, CVE-2007-0008, CVE-2007-000
bugzilla·2007-02-26·CVSS 5.0
CVE-2007-0775 [MEDIUM] CVE-2007-0775 Multiple Firefox flaws (CVE-2007-0777, CVE-2007-0994, CVE-2007-0995, CVE-2007-0996, CVE-2006-6077, CVE-2007-0778, CVE-2007-0779, CVE-2007-0780, CVE-2007-0800, CVE-2007-0008, CVE-2007-000
CVE-2007-0775 Multiple Firefox flaws (CVE-2007-0777, CVE-2007-0994, CVE-2007-0995, CVE-2007-0996, CVE-2006-6077, CVE-2007-0778, CVE-2007-0779, CVE-2007-0780, CVE-2007-0800, CVE-2007-0008, CVE-2007-0009, CVE-2007-0981)
+++ This bug was initially created as a clone of Bug #229802 +++
The Mozilla project is releasing Firefox 1.5.0.10 to fix several flaws:
mfsa2007-01
impact=critical,source=mozilla,reported=20070222,public=20070223
CVE-2007-0775
Jesse Ruderman, Martijn Wargers and Olli Pettay reported crashes in the
layout engine
CVE-2007-0777
Brian Crowder, Igor Bukanov, Johnny Stenback, moz_bug_r_a4 and shutdown
reported potential memory corruption in the JavaScript engine
mfsa2007-02
impact=moderate,source=mozilla,reported=20070222,public=20070223
CVE-2007-0995
The Mozilla parser for
ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.ascftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.aschttp://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230733http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.htmlhttp://secunia.com/advisories/24384http://secunia.com/advisories/24395http://secunia.com/advisories/24455http://secunia.com/advisories/24457http://secunia.com/advisories/24650http://secunia.com/advisories/25588http://securitytracker.com/id?1017726http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851http://www.debian.org/security/2007/dsa-1336http://www.mozilla.org/security/announce/2007/mfsa2007-09.htmlhttp://www.novell.com/linux/security/advisories/2007_22_mozilla.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0078.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0097.htmlhttp://www.securityfocus.com/bid/22826http://www.vupen.com/english/advisories/2007/0823https://issues.rpath.com/browse/RPL-1103https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9749ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.ascftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.aschttp://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230733http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.htmlhttp://secunia.com/advisories/24384http://secunia.com/advisories/24395http://secunia.com/advisories/24455http://secunia.com/advisories/24457http://secunia.com/advisories/24650http://secunia.com/advisories/25588http://securitytracker.com/id?1017726http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851http://www.debian.org/security/2007/dsa-1336http://www.mozilla.org/security/announce/2007/mfsa2007-09.htmlhttp://www.novell.com/linux/security/advisories/2007_22_mozilla.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0078.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0097.htmlhttp://www.securityfocus.com/bid/22826http://www.vupen.com/english/advisories/2007/0823https://issues.rpath.com/browse/RPL-1103https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9749
2007-03-06
Published