Home > Vulnerability Database > CVE-2007-3089

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2007-3089

Date: June 6, 2007

Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code that intercepts keystroke values from window.event, aka the "promiscuous IFRAME access bug," a related issue to CVE-2006-4568.

Severity Score

3.7

Related Resources (55)

Url: http://secunia.com/advisories/26072

Url: http://www.securityfocus.com/archive/1/474226/100/0/threaded

Url: http://secunia.com/advisories/26151

Url: http://secunia.com/advisories/26271

Url: http://www.vupen.com/english/advisories/2007/4256

Url: http://secunia.com/advisories/26107

Url: http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

Url: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Url: http://www.redhat.com/support/errata/RHSA-2007-0723.html

Url: http://secunia.com/advisories/26106

Url: http://secunia.com/advisories/26149

Url: http://secunia.com/advisories/26103

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Url: http://www.debian.org/security/2007/dsa-1339

Url: http://www.mozilla.org/security/announce/2007/mfsa2007-20.html

Url: http://www.debian.org/security/2007/dsa-1338

Url: http://www.securityfocus.com/archive/1/474542/100/0/threaded

Url: https://access.redhat.com/security/cve/CVE-2007-3089

Url: http://www.ubuntu.com/usn/usn-490-1

Url: http://www.debian.org/security/2007/dsa-1337

Url: http://www.redhat.com/support/errata/RHSA-2007-0722.html

Url: ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc

Url: https://nvd.nist.gov/vuln/detail/CVE-2007-3089

Url: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Url: http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html

Url: http://www.us-cert.gov/cas/techalerts/TA07-199A.html

Url: http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

Url: http://www.securityfocus.com/bid/24286

Url: http://secunia.com/advisories/25589

Url: http://secunia.com/advisories/28135

Url: http://securityreason.com/securityalert/2781

Url: http://www.securityfocus.com/archive/1/470446/100/0/threaded

Url: http://secunia.com/advisories/26159

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=382686

Url: http://secunia.com/advisories/26095

Url: http://osvdb.org/38024

Url: http://lcamtuf.coredump.cx/ifsnatch/

Url: http://secunia.com/advisories/26205

Url: http://secunia.com/advisories/26204

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/34701

Url: http://secunia.com/advisories/26460

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11122

Url: http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=381300

Url: http://www.securitytracker.com/id?1018412

Url: http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1

Url: http://www.vupen.com/english/advisories/2007/2564

Url: http://www.redhat.com/support/errata/RHSA-2007-0724.html

Url: http://secunia.com/advisories/26179

Url: http://www.kb.cert.org/vuls/id/143297

Url: http://secunia.com/advisories/26211

Url: http://secunia.com/advisories/26216

Url: http://secunia.com/advisories/26258

Url: https://www.mend.io/vulnerability-database/CVE-2007-3089

Severity Score

3.7

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us