National Cyber Awareness System

Vulnerability Summary for CVE-2007-3736

Overview

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECUNIA

Name: 26095

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/26095

External Source: VUPEN

Name: ADV-2007-4256

Hyperlink:http://www.vupen.com/english/advisories/2007/4256

External Source: VUPEN

Name: ADV-2007-2564

Hyperlink:http://www.vupen.com/english/advisories/2007/2564

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2007/mfsa2007-19.html

Hyperlink:http://www.mozilla.org/security/announce/2007/mfsa2007-19.html

External Source: OVAL

Name: oval:org.mitre.oval:def:11749

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11749

External Source: HP

Name: SSRT061181

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: XF

Name: mozilla-addeventlistener-settimeout-xss(35462)

Hyperlink:http://xforce.iss.net/xforce/xfdb/35462

External Source: UBUNTU

Name: USN-490-1

Hyperlink:http://www.ubuntu.com/usn/usn-490-1

External Source: SECTRACK

Name: 1018410

Hyperlink:http://www.securitytracker.com/id?1018410

External Source: BID

Name: 24946

Hyperlink:http://www.securityfocus.com/bid/24946

External Source: BUGTRAQ

Name: 20070724 FLEA-2007-0033-1: firefox thunderbird

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/474542/100/0/threaded

External Source: BUGTRAQ

Name: 20070720 rPSA-2007-0148-1 firefox thunderbird

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/474226/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0724

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0724.html

External Source: REDHAT

Name: RHSA-2007:0723

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0723.html

External Source: REDHAT

Name: RHSA-2007:0722

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0722.html

External Source: SUSE

Name: SUSE-SA:2007:049

Hyperlink:http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

External Source: MANDRIVA

Name: MDKSA-2007:152

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

External Source: GENTOO

Name: GLSA-200708-09

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml

External Source: DEBIAN

Name: DSA-1339

Hyperlink:http://www.debian.org/security/2007/dsa-1339

External Source: DEBIAN

Name: DSA-1338

Hyperlink:http://www.debian.org/security/2007/dsa-1338

External Source: DEBIAN

Name: DSA-1337

Hyperlink:http://www.debian.org/security/2007/dsa-1337

External Source: CONFIRM

Name: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Hyperlink:http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

External Source: SUNALERT

Name: 201516

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

External Source: SUNALERT

Name: 103177

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1

External Source: SECUNIA

Name: 28135

Hyperlink:http://secunia.com/advisories/28135

External Source: SECUNIA

Name: 26460

Hyperlink:http://secunia.com/advisories/26460

External Source: SECUNIA

Name: 26271

Hyperlink:http://secunia.com/advisories/26271

External Source: SECUNIA

Name: 26258

Hyperlink:http://secunia.com/advisories/26258

External Source: SECUNIA

Name: 26216

Hyperlink:http://secunia.com/advisories/26216

External Source: SECUNIA

Name: 26211

Hyperlink:http://secunia.com/advisories/26211

External Source: SECUNIA

Name: 26205

Hyperlink:http://secunia.com/advisories/26205

External Source: SECUNIA

Name: 26204

Hyperlink:http://secunia.com/advisories/26204

External Source: SECUNIA

Name: 26179

Hyperlink:http://secunia.com/advisories/26179

External Source: SECUNIA

Name: 26159

Hyperlink:http://secunia.com/advisories/26159

External Source: SECUNIA

Name: 26151

Hyperlink:http://secunia.com/advisories/26151

External Source: SECUNIA

Name: 26149

Hyperlink:http://secunia.com/advisories/26149

External Source: SECUNIA

Name: 26107

Hyperlink:http://secunia.com/advisories/26107

External Source: SECUNIA

Name: 26106

Hyperlink:http://secunia.com/advisories/26106

External Source: SECUNIA

Name: 26103

Hyperlink:http://secunia.com/advisories/26103

External Source: SECUNIA

Name: 26072

Hyperlink:http://secunia.com/advisories/26072

External Source: SECUNIA

Name: 25589

Hyperlink:http://secunia.com/advisories/25589

External Source: HP

Name: SSRT061181

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: SGI

Name: 20070701-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc

External Source: CONFIRM

Name: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Hyperlink:ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

References to Check Content

Identifier:oval:org.mitre.oval:def:11749

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11749