CVE-2007-2292
NoneCVSS
—
EPSS
12.7%
Published
Apr 26, 2007
CISA due date
—
The record
CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | iceape | 0 | 1.0.11~pre071022-0etch1 |
| Debian:4.0 | iceweasel | 0 | 2.0.0.6+2.0.0.8-0etch1 |
| Debian:4.0 | xulrunner | 0 | 1.8.0.14~pre071019b-0etch1 |
| Debian:5.0 | iceape | 0 | 1.0.11~pre071022-0etch1+lenny1 |
| Debian:5.0 | xulrunner | 0 | 1.8.0.14~pre071019b-0lenny1 |
| Red Hat:enterprise_linux:2.1::as | seamonkey | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-chat | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-dom-inspector | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-js-debugger | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-mail | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-nspr | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-nspr-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-nss | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::as | seamonkey-nss-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-chat | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-dom-inspector | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-js-debugger | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-mail | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-nspr | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-nspr-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-nss | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::aw | seamonkey-nss-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-chat | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-dom-inspector | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-js-debugger | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-mail | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-nspr | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-nspr-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-nss | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::es | seamonkey-nss-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-chat | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-dom-inspector | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-js-debugger | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-mail | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-nspr | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-nspr-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-nss | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:2.1::ws | seamonkey-nss-devel | 0 | 0:1.0.9-0.6.el2 |
| Red Hat:enterprise_linux:3::as | seamonkey | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-chat | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-debuginfo | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-dom-inspector | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-js-debugger | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-mail | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nspr | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nspr-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nss | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::as | seamonkey-nss-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-chat | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-debuginfo | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-dom-inspector | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-js-debugger | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-mail | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nspr | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nspr-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nss | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::desktop | seamonkey-nss-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-chat | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-debuginfo | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-dom-inspector | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-js-debugger | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-mail | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nspr | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nspr-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nss | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::es | seamonkey-nss-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-chat | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-debuginfo | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-dom-inspector | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-js-debugger | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-mail | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nspr | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nspr-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nss | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:3::ws | seamonkey-nss-devel | 0 | 0:1.0.9-0.5.el3 |
| Red Hat:enterprise_linux:4::as | firefox | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::as | firefox-debuginfo | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey-chat | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey-debuginfo | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey-devel | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey-dom-inspector | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey-js-debugger | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::as | seamonkey-mail | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::as | thunderbird | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:4::as | thunderbird-debuginfo | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:4::desktop | firefox | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::desktop | firefox-debuginfo | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-chat | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-debuginfo | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-devel | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-dom-inspector | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-js-debugger | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::desktop | seamonkey-mail | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::desktop | thunderbird | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:4::desktop | thunderbird-debuginfo | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:4::es | firefox | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::es | firefox-debuginfo | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey-chat | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey-debuginfo | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey-devel | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey-dom-inspector | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey-js-debugger | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::es | seamonkey-mail | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::es | thunderbird | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:4::es | thunderbird-debuginfo | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:4::ws | firefox | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::ws | firefox-debuginfo | 0 | 0:1.5.0.12-0.7.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey-chat | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey-debuginfo | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey-devel | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey-dom-inspector | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey-js-debugger | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::ws | seamonkey-mail | 0 | 0:1.0.9-6.el4 |
| Red Hat:enterprise_linux:4::ws | thunderbird | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:4::ws | thunderbird-debuginfo | 0 | 0:1.5.0.12-0.5.el4 |
| Red Hat:enterprise_linux:5::client | firefox | 0 | 0:1.5.0.12-6.el5 |
| Red Hat:enterprise_linux:5::client | firefox-debuginfo | 0 | 0:1.5.0.12-6.el5 |
| Red Hat:enterprise_linux:5::client | thunderbird | 0 | 0:1.5.0.12-5.el5 |
| Red Hat:enterprise_linux:5::client | thunderbird-debuginfo | 0 | 0:1.5.0.12-5.el5 |
| Red Hat:enterprise_linux:5::server | firefox | 0 | 0:1.5.0.12-6.el5 |
| Red Hat:enterprise_linux:5::server | firefox-debuginfo | 0 | 0:1.5.0.12-6.el5 |
Related vulnerabilities
- CVE-2008-4582 Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x… Also affects iceape
- CVE-2008-0016 Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before… Also affects iceape
- CVE-2008-2798 Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird… Also affects iceape
- CVE-2007-4041 Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow… Also affects iceape
- CVE-2011-2371 Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x… Also affects xulrunner
- CVE-2010-3765 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… Also affects xulrunner
- CVE-2010-3179 Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before… Also affects xulrunner
- CVE-2010-1205 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… Also affects xulrunner