SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Browser)  >   Mozilla Firefox Vendors:   Mozilla.org
Mozilla Firefox May Disclose Files or Information to Remote Users
SecurityTracker Alert ID:  1018837
SecurityTracker URL:  http://securitytracker.com/id/1018837
CVE Reference:   CVE-2006-2894, CVE-2007-1095, CVE-2007-3511, CVE-2007-5334, CVE-2007-5337   (Links to External Site)
Updated:  Oct 19 2007
Original Entry Date:  Oct 19 2007
Impact:   Disclosure of system information, Disclosure of user information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.0.0.8
Description:   A vulnerability was reported in Mozilla Firefox. A remote user may be able to obtain certain files or information from the target user's system. A remote user may be able to spoof elements of the browser interface.

A remote user can create HTML that, when loaded by the target user, will obtain files or information.

OnUnload event handlers can access to the address of certain other pages [CVE-2007-1095]. A remote user can exploit this to obtain bookmarks.

A file upload control can be automatically filled out by a remote user to steal known files from the target user's system [CVE-2006-2894, CVE-2007-3511].

An XUL markup language page can hide the page window's titlebar [CVE-2007-5334].

A remote user can create a page on an SMB share or SFTP site that, when loaded by the target user, will access files on the target system with the privileges of the target user [CVE-2007-5337]. Linux machines with gnome-vfs are affected.

Michal Zalewski, hong, Eli Friedman, and Georgi Guninski reported these vulnerabilities.

Impact:   A remote user obtain certain files or information from the target user's system.

A remote user can spoof elements of the browser interface.

Solution:   The vendor has issued a fixed version (2.0.0.8).

The Mozilla advisories are available at:

http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.mozilla.org/security/announce/2007/mfsa2007-33.html
http://www.mozilla.org/security/announce/2007/mfsa2007-34.html

Vendor URL:  www.mozilla.org/security/announce/2007/mfsa2007-34.html (Links to External Site)
Cause:   Access control error
Underlying OS:   Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Thu, 18 Oct 2007 23:34:31 -0400
Subject:  Mozilla Firefox


http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.mozilla.org/security/announce/2007/mfsa2007-33.html
http://www.mozilla.org/security/announce/2007/mfsa2007-34.html

CVE-2007-1095
CVE-2007-3511
CVE-2006-2894
CVE-2007-5334
CVE-2007-5337
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC