Mozilla Firefox May Disclose Files or Information to Remote Users
|
|
SecurityTracker Alert ID: 1018837 |
|
SecurityTracker URL: http://securitytracker.com/id/1018837
|
|
CVE Reference:
CVE-2006-2894, CVE-2007-1095, CVE-2007-3511, CVE-2007-5334, CVE-2007-5337
(Links to External Site)
|
Updated: Oct 19 2007
|
Original Entry Date: Oct 19 2007
|
Impact:
Disclosure of system information, Disclosure of user information, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 2.0.0.8
|
Description:
A vulnerability was reported in Mozilla Firefox. A remote user may be able to obtain certain files or information from the target user's system. A remote user may be able to spoof elements of the browser interface.
A remote user can create HTML that, when loaded by the target user, will obtain files or information.
OnUnload event handlers can access to the address of certain other pages [CVE-2007-1095]. A remote user can exploit this to obtain bookmarks.
A file upload control can be automatically filled out by a remote user to steal known files from the target user's system [CVE-2006-2894, CVE-2007-3511].
An XUL markup language page can hide the page window's titlebar [CVE-2007-5334].
A remote user can create a page on an SMB share or SFTP site that, when loaded by the target user, will access files on the target system with the privileges of the target user [CVE-2007-5337]. Linux machines with gnome-vfs are affected.
Michal Zalewski, hong, Eli Friedman, and Georgi Guninski reported these vulnerabilities.
|
Impact:
A remote user obtain certain files or information from the target user's system.
A remote user can spoof elements of the browser interface.
|
Solution:
The vendor has issued a fixed version (2.0.0.8).
The Mozilla advisories are available at:
http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.mozilla.org/security/announce/2007/mfsa2007-33.html
http://www.mozilla.org/security/announce/2007/mfsa2007-34.html
|
Vendor URL: www.mozilla.org/security/announce/2007/mfsa2007-34.html (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 18 Oct 2007 23:34:31 -0400
Subject: Mozilla Firefox
|
http://www.mozilla.org/security/announce/2007/mfsa2007-30.html
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.mozilla.org/security/announce/2007/mfsa2007-33.html
http://www.mozilla.org/security/announce/2007/mfsa2007-34.html
CVE-2007-1095
CVE-2007-3511
CVE-2006-2894
CVE-2007-5334
CVE-2007-5337
|
|
