National Cyber Awareness System

Vulnerability Summary for CVE-2007-5947

Overview

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#715737

Name: VU#715737

Hyperlink:http://www.kb.cert.org/vuls/id/715737

External Source: FEDORA

Name: FEDORA-2007-3952

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html

External Source: FEDORA

Name: FEDORA-2007-4098

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html

External Source: FEDORA

Name: FEDORA-2007-4106

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html

External Source: FEDORA

Name: FEDORA-2007-756

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1984

Hyperlink:https://issues.rpath.com/browse/RPL-1984

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=369814

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=369814

External Source: XF

Name: firefox-jar-uri-xss(38356)

Hyperlink:http://xforce.iss.net/xforce/xfdb/38356

External Source: VUPEN

Name: ADV-2008-0643

Hyperlink:http://www.vupen.com/english/advisories/2008/0643

External Source: VUPEN

Name: ADV-2008-0083

Hyperlink:http://www.vupen.com/english/advisories/2008/0083

External Source: VUPEN

Name: ADV-2007-4018

Hyperlink:http://www.vupen.com/english/advisories/2007/4018

External Source: VUPEN

Name: ADV-2007-4002

Hyperlink:http://www.vupen.com/english/advisories/2007/4002

External Source: VUPEN

Name: ADV-2007-3818

Hyperlink:http://www.vupen.com/english/advisories/2007/3818

External Source: UBUNTU

Name: USN-546-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-546-1

External Source: UBUNTU

Name: USN-546-2

Hyperlink:http://www.ubuntu.com/usn/usn-546-2

External Source: SECTRACK

Name: 1018928

Hyperlink:http://www.securitytracker.com/id?1018928

External Source: BID

Name: 26385

Hyperlink:http://www.securityfocus.com/bid/26385

External Source: BUGTRAQ

Name: 20080229 rPSA-2008-0093-1 thunderbird

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/488971/100/0/threaded

External Source: BUGTRAQ

Name: 20080212 FLEA-2008-0001-1 firefox

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/488002/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:1084

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1084.html

External Source: REDHAT

Name: RHSA-2007:1083

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1083.html

External Source: REDHAT

Name: RHSA-2007:1082

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1082.html

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2007/mfsa2007-37.html

Type: Advisory

Hyperlink:http://www.mozilla.org/security/announce/2007/mfsa2007-37.html

External Source: MANDRIVA

Name: MDKSA-2007:246

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:246

External Source: MISC

Name: http://www.gnucitizen.org/blog/web-mayhem-firefoxs-jar-protocol-issues

Hyperlink:http://www.gnucitizen.org/blog/web-mayhem-firefoxs-jar-protocol-issues

External Source: DEBIAN

Name: DSA-1425

Hyperlink:http://www.debian.org/security/2007/dsa-1425

External Source: DEBIAN

Name: DSA-1424

Hyperlink:http://www.debian.org/security/2007/dsa-1424

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2008-0093

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2008-0093

External Source: SUNALERT

Name: 1018977

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1

External Source: SUNALERT

Name: 231441

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1

External Source: SLACKWARE

Name: SSA:2007-331-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833

External Source: SLACKWARE

Name: SSA:2007-333-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006

External Source: GENTOO

Name: GLSA-200712-21

Hyperlink:http://security.gentoo.org/glsa/glsa-200712-21.xml

External Source: SECUNIA

Name: 28398

Type: Advisory

Hyperlink:http://secunia.com/advisories/28398

External Source: SECUNIA

Name: 28277

Type: Advisory

Hyperlink:http://secunia.com/advisories/28277

External Source: SECUNIA

Name: 28171

Type: Advisory

Hyperlink:http://secunia.com/advisories/28171

External Source: SECUNIA

Name: 28016

Type: Advisory

Hyperlink:http://secunia.com/advisories/28016

External Source: SECUNIA

Name: 28001

Type: Advisory

Hyperlink:http://secunia.com/advisories/28001

External Source: SECUNIA

Name: 27979

Type: Advisory

Hyperlink:http://secunia.com/advisories/27979

External Source: SECUNIA

Name: 27957

Type: Advisory

Hyperlink:http://secunia.com/advisories/27957

External Source: SECUNIA

Name: 27955

Type: Advisory

Hyperlink:http://secunia.com/advisories/27955

External Source: SECUNIA

Name: 27944

Type: Advisory

Hyperlink:http://secunia.com/advisories/27944

External Source: SECUNIA

Name: 27855

Type: Advisory

Hyperlink:http://secunia.com/advisories/27855

External Source: SECUNIA

Name: 27845

Type: Advisory

Hyperlink:http://secunia.com/advisories/27845

External Source: SECUNIA

Name: 27838

Type: Advisory

Hyperlink:http://secunia.com/advisories/27838

External Source: SECUNIA

Name: 27816

Type: Advisory

Hyperlink:http://secunia.com/advisories/27816

External Source: SECUNIA

Name: 27800

Type: Advisory

Hyperlink:http://secunia.com/advisories/27800

External Source: SECUNIA

Name: 27797

Type: Advisory

Hyperlink:http://secunia.com/advisories/27797

External Source: SECUNIA

Name: 27796

Type: Advisory

Hyperlink:http://secunia.com/advisories/27796

External Source: SECUNIA

Name: 27793

Type: Advisory

Hyperlink:http://secunia.com/advisories/27793

External Source: SECUNIA

Name: 27605

Type: Advisory

Hyperlink:http://secunia.com/advisories/27605

External Source: OVAL

Name: oval:org.mitre.oval:def:9873

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9873

External Source: SUSE

Name: SUSE-SA:2007:066

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html

External Source: HP

Name: SSRT061181

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: HP

Name: SSRT061181

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: MISC

Name: http://bugs.gentoo.org/show_bug.cgi?id=200909

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=200909

External Source: MISC

Name: http://bugs.gentoo.org/show_bug.cgi?id=198965

Hyperlink:http://bugs.gentoo.org/show_bug.cgi?id=198965

External Source: CONFIRM

Name: http://browser.netscape.com/releasenotes/

Hyperlink:http://browser.netscape.com/releasenotes/

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1995

Hyperlink:https://issues.rpath.com/browse/RPL-1995

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093

External Source: SECUNIA

Name: 29164

Hyperlink:http://secunia.com/advisories/29164

References to Check Content

Identifier:oval:org.mitre.oval:def:9873

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9873