vulnwire
5.0med

CVE-2007-4879

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user in…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 70%
Public exploits
0
none known

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains.

Exploit prediction (EPSS)

1.27% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

References

  • securityfocus.com /archive/1/490196/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/29541 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29539 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securitytracker.com /id?1019704 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • secunia.com /advisories/30620 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29560 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2008/dsa-1532 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/30327 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-238492-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • ubuntu.com /usn/usn-592-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/29616 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29645 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • 0x90.eu /ff_tls_poc.html · x_refsource_MISC, x_transferred
  • vupen.com /english/advisories/2008/1793/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/29558 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/29526 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-04/msg00002.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • us-cert.gov /cas/techalerts/TA08-087A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • mozilla.org /security/announce/2008/mfsa2008-17.html · x_refsource_CONFIRM, x_transferred
  • bugzilla.mozilla.org /show_bug.cgi?id=395399 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/28448 · vdb-entry, x_refsource_BID, x_transferred
  • debian.org /security/2008/dsa-1534 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/29547 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • gentoo.org /security/en/glsa/glsa-200805-18.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • wiki.rpath.com /wiki/Advisories:rPSA-2008-0128 · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2008/0998/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • debian.org /security/2008/dsa-1535 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:080 · vendor-advisory, x_refsource_MANDRIVA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.