CVE

Id
27395  
CVE No.
CVE-2007-4038  
Status
Candidate  
Description
Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670.  
Phase
Assigned (20070727)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
281804 27395 CVE-2007-4038 BUGTRAQ:20070725 Mozilla protocol abuse  View
281805 27395 CVE-2007-4038 URL:http://www.securityfocus.com/archive/1/archive/1/474624/100/0/threaded  View
281806 27395 CVE-2007-4038 BUGTRAQ:20070726 Re: Mozilla protocol abuse  View
281807 27395 CVE-2007-4038 URL:http://www.securityfocus.com/archive/1/archive/1/474686/100/0/threaded  View
281808 27395 CVE-2007-4038 FULLDISC:20070725 Mozilla protocol abuse  View
281809 27395 CVE-2007-4038 URL:http://seclists.org/fulldisclosure/2007/Jul/0557.html  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
55498 JVNDB-2007-004190 Microsoft Outlook および Outlook Express における任意のコマンドを実行される脆弱性 Microsoft Outlook および Outlook Express は、特定の URI が登録されている際、引数の挿入により、クロスブラウザスクリプティング攻撃を実行される、および任意のコマンドを実行される脆弱性が存在します。 CVE-2007-4040 27395 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-004190.html  View