CVE-2007-3738 - Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to exe

CVE-2007-3738

Summary

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper.

References

Vulnerable Configurations

cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 15-10-2018 - 21:30)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

oval via4

accepted

2013-04-29T04:22:58.436-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 3
oval oval:org.mitre.oval:def:11782
comment CentOS Linux 3.x
oval oval:org.mitre.oval:def:16651
comment The operating system installed on the system is Red Hat Enterprise Linux 4
oval oval:org.mitre.oval:def:11831
comment CentOS Linux 4.x
oval oval:org.mitre.oval:def:16636
comment Oracle Linux 4.x
oval oval:org.mitre.oval:def:15990
comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper.

family

unix

oval:org.mitre.oval:def:9875

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper.

version

redhat via4

advisories

bugzilla

id	1618322
title	CVE-2007-3738 security flaw

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025

AND
comment seamonkey is earlier than 0:1.0.9-4.el4
oval oval:com.redhat.rhsa:tst:20070722001
comment seamonkey is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060609002
AND
comment seamonkey-chat is earlier than 0:1.0.9-4.el4
oval oval:com.redhat.rhsa:tst:20070722003
comment seamonkey-chat is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060609004
AND
comment seamonkey-devel is earlier than 0:1.0.9-4.el4
oval oval:com.redhat.rhsa:tst:20070722005
comment seamonkey-devel is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060609006

AND

comment seamonkey-dom-inspector is earlier than 0:1.0.9-4.el4
oval oval:com.redhat.rhsa:tst:20070722007
comment seamonkey-dom-inspector is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060609008

AND

comment seamonkey-js-debugger is earlier than 0:1.0.9-4.el4
oval oval:com.redhat.rhsa:tst:20070722009
comment seamonkey-js-debugger is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060609010

AND
comment seamonkey-mail is earlier than 0:1.0.9-4.el4
oval oval:com.redhat.rhsa:tst:20070722011
comment seamonkey-mail is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060609012

rhsa

id	RHSA-2007:0722
released	2007-07-19
severity	Critical
title	RHSA-2007:0722: seamonkey security update (Critical)

bugzilla

id	1618322
title	CVE-2007-3738 security flaw

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025
comment thunderbird is earlier than 0:1.5.0.12-0.3.el4
oval oval:com.redhat.rhsa:tst:20070723001
comment thunderbird is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060330002

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005
comment thunderbird is earlier than 0:1.5.0.12-3.el5
oval oval:com.redhat.rhsa:tst:20070723004
comment thunderbird is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070108002

rhsa

id	RHSA-2007:0723
released	2007-07-19
severity	Moderate
title	RHSA-2007:0723: thunderbird security update (Moderate)

bugzilla

id	1618322
title	CVE-2007-3738 security flaw

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025
comment firefox is earlier than 0:1.5.0.12-0.3.el4
oval oval:com.redhat.rhsa:tst:20070724001
comment firefox is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060200002

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005
comment firefox is earlier than 0:1.5.0.12-3.el5
oval oval:com.redhat.rhsa:tst:20070724004
comment firefox is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070097008

rhsa

id	RHSA-2007:0724
released	2007-07-19
severity	Critical
title	RHSA-2007:0724: firefox security update (Critical)

rpms

seamonkey-0:1.0.9-0.3.el3
seamonkey-0:1.0.9-0.4.el2
seamonkey-0:1.0.9-4.el4
seamonkey-chat-0:1.0.9-0.3.el3
seamonkey-chat-0:1.0.9-0.4.el2
seamonkey-chat-0:1.0.9-4.el4
seamonkey-debuginfo-0:1.0.9-0.3.el3
seamonkey-debuginfo-0:1.0.9-4.el4
seamonkey-devel-0:1.0.9-0.3.el3
seamonkey-devel-0:1.0.9-0.4.el2
seamonkey-devel-0:1.0.9-4.el4
seamonkey-dom-inspector-0:1.0.9-0.3.el3
seamonkey-dom-inspector-0:1.0.9-0.4.el2
seamonkey-dom-inspector-0:1.0.9-4.el4
seamonkey-js-debugger-0:1.0.9-0.3.el3
seamonkey-js-debugger-0:1.0.9-0.4.el2
seamonkey-js-debugger-0:1.0.9-4.el4
seamonkey-mail-0:1.0.9-0.3.el3
seamonkey-mail-0:1.0.9-0.4.el2
seamonkey-mail-0:1.0.9-4.el4
seamonkey-nspr-0:1.0.9-0.3.el3
seamonkey-nspr-0:1.0.9-0.4.el2
seamonkey-nspr-devel-0:1.0.9-0.3.el3
seamonkey-nspr-devel-0:1.0.9-0.4.el2
seamonkey-nss-0:1.0.9-0.3.el3
seamonkey-nss-0:1.0.9-0.4.el2
seamonkey-nss-devel-0:1.0.9-0.3.el3
seamonkey-nss-devel-0:1.0.9-0.4.el2
thunderbird-0:1.5.0.12-0.3.el4
thunderbird-0:1.5.0.12-3.el5
thunderbird-debuginfo-0:1.5.0.12-0.3.el4
thunderbird-debuginfo-0:1.5.0.12-3.el5
firefox-0:1.5.0.12-0.3.el4
firefox-0:1.5.0.12-3.el5
firefox-debuginfo-0:1.5.0.12-0.3.el4
firefox-debuginfo-0:1.5.0.12-3.el5

refmap via4

bid	24946
bugtraq	20070720 rPSA-2007-0148-1 firefox thunderbird 20070724 FLEA-2007-0033-1: firefox thunderbird
confirm	ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html http://www.mozilla.org/security/announce/2007/mfsa2007-25.html
debian	DSA-1337 DSA-1338 DSA-1339
gentoo	GLSA-200708-09
hp	HPSBUX02153 SSRT061181
mandriva	MDKSA-2007:152
sectrack	1018414
secunia	25589 26072 26095 26103 26106 26107 26149 26151 26159 26179 26204 26205 26211 26216 26258 26271 26460 28135
sgi	20070701-01-P
sunalert	103177 201516
suse	SUSE-SA:2007:049 SUSE-SA:2007:057
ubuntu	USN-490-1
vupen	ADV-2007-2564 ADV-2007-4256
xf	firefox-xpcnativewrapper-code-execution(35460)

Last major update

15-10-2018 - 21:30

Published

18-07-2007 - 17:30

Last modified

15-10-2018 - 21:30