Vulnerability Details : CVE-2007-3656
Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via (1) HTTP 302 redirect controls, (2) XMLHttpRequest, or (3) view-source URIs.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2007-3656
Probability of exploitation activity in the next 30 days: 94.24%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-3656
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2007-3656
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2007-3656
-
http://www.securityfocus.com/bid/24831
- http://www.debian.org/security/2007/dsa-1337
- http://www.debian.org/security/2007/dsa-1339
-
http://www.securityfocus.com/archive/1/473191/100/0/threaded
- ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc
- http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml
-
http://www.securitytracker.com/id?1018411
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/35298
- http://www.ubuntu.com/usn/usn-490-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9105
- http://www.redhat.com/support/errata/RHSA-2007-0724.html
- http://www.novell.com/linux/security/advisories/2007_49_mozilla.html
-
http://lcamtuf.coredump.cx/ffcache/
Exploit
- ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt
- http://www.vupen.com/english/advisories/2007/4256
- http://www.securityfocus.com/archive/1/474542/100/0/threaded
-
http://securityreason.com/securityalert/2872
- http://www.debian.org/security/2007/dsa-1338
- http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html
-
https://bugzilla.mozilla.org/show_bug.cgi?id=387333
Exploit
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:152
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
-
http://www.mozilla.org/security/announce/2007/mfsa2007-24.html
- http://www.redhat.com/support/errata/RHSA-2007-0722.html
- http://www.securityfocus.com/archive/1/474226/100/0/threaded
Products affected by CVE-2007-3656
- cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*