CVE-2007-4041
NoneCVSS
—
EPSS
19.7%
Published
Jul 27, 2007
CISA due date
—
The record
Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | iceape | 0 | 1.0.10~pre070720-0etch3 |
| Debian:4.0 | iceweasel | 0 | 2.0.0.6-0etch1 |
| Debian:4.0 | xulrunner | 0 | 1.8.0.13~pre070720-0etch3 |
| Debian:5.0 | iceape | 0 | 1.0.10~pre070720-0etch3+lenny1 |
| Debian:5.0 | iceweasel | 0 | 2.0.0.6-0etch1+lenny1 |
| Debian:5.0 | xulrunner | 0 | 1.8.0.13~pre070720-0etch3+lenny1 |
Related vulnerabilities
- CVE-2008-4582 Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x… Also affects iceape
- CVE-2008-0016 Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before… Also affects iceape
- CVE-2008-2798 Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.15, Thunderbird… Also affects iceape
- CVE-2007-2292 CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox… Also affects iceape
- CVE-2011-2371 Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x… Also affects xulrunner
- CVE-2010-3765 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… Also affects xulrunner
- CVE-2010-3179 Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before… Also affects xulrunner
- CVE-2010-1205 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in… Also affects xulrunner