vulnwire
9.3crit

CVE-2007-38451 exploit

Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to ex…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.7%
percentile 93%
Public exploits
1
Exploit-DB

Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler."

Exploit prediction (EPSS)

5.70% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

Exploits and detections

  • EDB-30381 Multiple Browsers - URI Handlers Command Injection · remote · 2007-07-25

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

References

  • mozilla.org /security/announce/2007/mfsa2007-27.html · x_refsource_CONFIRM, x_transferred
  • issues.rpath.com /browse/RPL-1600 · x_refsource_CONFIRM, x_transferred
  • ubuntu.com /usn/usn-503-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:047 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • secunia.com /advisories/27414 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c00774579 · vendor-advisory, x_refsource_HP, x_transferred
  • secunia.com /advisories/26393 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/26303 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2007/4256 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /bid/25053 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/26309 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?objectID=c00771742 · vendor-advisory, x_refsource_HP, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2007:152 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • debian.org /security/2007/dsa-1345 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • debian.org /security/2007/dsa-1391 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • bugzilla.mozilla.org /show_bug.cgi?id=389580 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2007/dsa-1346 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • bugzilla.mozilla.org /show_bug.cgi?id=389106 · x_refsource_CONFIRM, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2007:047 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • secunia.com /advisories/28135 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2008/0082 · vdb-entry, x_refsource_VUPEN, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-103177-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • ubuntu.com /usn/usn-493-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/26234 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2007/dsa-1344 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/26258 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/27326 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/26331 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/475265/100/200/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-66-201516-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • securityfocus.com /archive/1/475450/30/5550/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/26335 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/26572 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • slackware.com /security/viewer.php?l=slackware-security&y=2007&m=slackware-security.010101 · vendor-advisory, x_refsource_SLACKWARE, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.