CVE-2007-3845

Upstream information

CVE-2007-3845 at MITRE

Description

Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler."

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	Complete
Availability Impact	Complete

SUSE Bugzilla entry: 297687 [RESOLVED / DUPLICATE]

SUSE Security Advisories:

• SUSE-SA:2007:057, published Thu, 25 Oct 2007 18:00:00 +0000

List of released packages

Product(s)	Fixed package version(s)	References
SUSE LINUX 10.0	mozilla >= 1.8_seamonkey_1.0.9-2.7 mozilla-calendar >= 1.8_seamonkey_1.0.9-2.7 mozilla-devel >= 1.8_seamonkey_1.0.9-2.7 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-2.7 mozilla-irc >= 1.8_seamonkey_1.0.9-2.7 mozilla-ko >= 1.75-3.5 mozilla-mail >= 1.8_seamonkey_1.0.9-2.7 mozilla-spellchecker >= 1.8_seamonkey_1.0.9-2.7 mozilla-venkman >= 1.8_seamonkey_1.0.9-2.7 mozilla-zh-CN >= 1.7-6.5 mozilla-zh-TW >= 1.7-6.5
SUSE LINUX Retail Solution 8 SuSE Linux Enterprise Server 8 for AMD64 SuSE Linux Enterprise Server 8 for IBM iSeries and IBM pSeries SuSE Linux Enterprise Server 8 for IBM zSeries SuSE Linux Enterprise Server 8 for IPF SuSE Linux Openexchange Server 4 SuSE Linux School Server for i386 SuSE Linux Standard Server 8 UnitedLinux 1.0	mozilla >= 1.8_seamonkey_1.0.9-0.14 mozilla-calendar >= 1.8_seamonkey_1.0.9-0.14 mozilla-devel >= 1.8_seamonkey_1.0.9-0.14 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-0.14 mozilla-irc >= 1.8_seamonkey_1.0.9-0.14 mozilla-mail >= 1.8_seamonkey_1.0.9-0.14 mozilla-spellchecker >= 1.8_seamonkey_1.0.9-0.14 mozilla-venkman >= 1.8_seamonkey_1.0.9-0.14 mozilla-xmlterm >= 1.8_seamonkey_1.0.9-0.14	slrs8.x86 ul1.s390 YOU Patch Nr: 11935
SUSE LINUX 10.1	seamonkey >= 1.0.9-1.5 seamonkey-calendar >= 1.0.9-1.5 seamonkey-dom-inspector >= 1.0.9-1.5 seamonkey-irc >= 1.0.9-1.5 seamonkey-mail >= 1.0.9-1.5 seamonkey-spellchecker >= 1.0.9-1.5 seamonkey-venkman >= 1.0.9-1.5
Novell Linux Desktop 9 for x86 Novell Linux Desktop 9 for x86_64	MozillaFirefox >= 1.5.0.12-0.5 MozillaFirefox-translations >= 1.5.0.12-0.5	Builds YOU Patch Nr: 11927
SUSE LINUX 10.1	MozillaFirefox >= 2.0.0.8-1.2 MozillaFirefox-translations >= 2.0.0.8-1.2
Novell Linux Desktop 9 for x86	mozilla >= 1.8_seamonkey_1.0.9-1.6 mozilla-cs >= 1.8_seamonkey_1.0.4-0.7 mozilla-deat >= 1.8_seamonkey_1.0.4-0.7 mozilla-devel >= 1.8_seamonkey_1.0.9-1.6 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.6 mozilla-hu >= 1.80_seamonkey_1.0.4-5 mozilla-irc >= 1.8_seamonkey_1.0.9-1.6 mozilla-mail >= 1.8_seamonkey_1.0.9-1.6 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.6	sles9-nld.x86-64 sles9-nld.x86 core9.x86 core9.s390 YOU Patch Nr: 11944
Novell Linux Desktop 9 for x86_64	mozilla >= 1.8_seamonkey_1.0.9-1.6 mozilla-cs >= 1.8_seamonkey_1.0.4-0.7 mozilla-deat >= 1.8_seamonkey_1.0.4-0.7 mozilla-devel >= 1.8_seamonkey_1.0.9-1.6 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.6 mozilla-hu >= 1.80_seamonkey_1.0.4-5 mozilla-irc >= 1.8_seamonkey_1.0.9-1.6 mozilla-lib64 >= 1.8_seamonkey_1.0.9-0.2 mozilla-mail >= 1.8_seamonkey_1.0.9-1.6 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.6	sles9-nld.x86-64 sles9-nld.x86 core9.x86 core9.s390 YOU Patch Nr: 11944
Open Enterprise Server	mozilla >= 1.8_seamonkey_1.0.9-1.6 mozilla-calendar >= 1.8_seamonkey_1.0.9-1.6 mozilla-cs >= 1.8_seamonkey_1.0.4-0.7 mozilla-deat >= 1.8_seamonkey_1.0.4-0.7 mozilla-devel >= 1.8_seamonkey_1.0.9-1.6 mozilla-dom-inspector >= 1.8_seamonkey_1.0.9-1.6 mozilla-hu >= 1.80_seamonkey_1.0.4-5 mozilla-irc >= 1.8_seamonkey_1.0.9-1.6 mozilla-mail >= 1.8_seamonkey_1.0.9-1.6 mozilla-venkman >= 1.8_seamonkey_1.0.9-1.6	sles9-nld.x86-64 sles9-nld.x86 core9.x86 core9.s390 YOU Patch Nr: 11944
SUSE LINUX 10.0	MozillaFirefox >= 2.0.0.8-1.1 MozillaFirefox-translations >= 2.0.0.8-1.1