CVE-2007-0800

Upstream information

CVE-2007-0800 at MITRE

Description

Cross-zone vulnerability in Mozilla Firefox 1.5.0.9 considers blocked popups to have an internal zone origin, which allows user-assisted remote attackers to cross zone restrictions and read arbitrary file:// URIs by convincing a user to show a blocked popup.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	4.3
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Partial
Integrity Impact	None
Availability Impact	None

SUSE Bugzilla entry: 244923 [RESOLVED / FIXED]

SUSE Security Advisories:

• SUSE-SA:2007:019, published Tue, 06 Mar 2007 18:00:00 +0000
• SUSE-SA:2007:022, published Tue, 20 Mar 2007 11:00:00 +0000

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Server 11 SP1	MozillaFirefox >= 3.5.9-0.1.1 MozillaFirefox-translations >= 3.5.9-0.1.1
SUSE Linux Enterprise Server 11 SP2	MozillaFirefox >= 10.0-0.3.2 MozillaFirefox-translations >= 10.0-0.3.2
SUSE Linux Enterprise Server 11 SP3	MozillaFirefox >= 17.0.4esr-0.10.42 MozillaFirefox-translations >= 17.0.4esr-0.10.42
SUSE Linux Enterprise Server 11 SP4	MozillaFirefox >= 31.7.0esr-0.8.1 MozillaFirefox-translations >= 31.7.0esr-0.8.1
SUSE Linux Enterprise Software Development Kit 11 SP4	MozillaFirefox-devel >= 31.7.0esr-0.8.1