{ "CVE_data_meta" : { "ASSIGNER" : "cve@mitre.org", "ID" : "CVE-2007-5947", "STATE" : "PUBLIC" }, "affects" : { "vendor" : { "vendor_data" : [ { "product" : { "product_data" : [ { "product_name" : "n/a", "version" : { "version_data" : [ { "version_value" : "n/a" } ] } } ] }, "vendor_name" : "n/a" } ] } }, "data_format" : "MITRE", "data_type" : "CVE", "data_version" : "4.0", "description" : { "description_data" : [ { "lang" : "eng", "value" : "The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI." } ] }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "eng", "value" : "n/a" } ] } ] }, "references" : { "reference_data" : [ { "name" : "20080212 FLEA-2008-0001-1 firefox", "refsource" : "BUGTRAQ", "url" : "http://www.securityfocus.com/archive/1/488002/100/0/threaded" }, { "name" : "20080229 rPSA-2008-0093-1 thunderbird", "refsource" : "BUGTRAQ", "url" : "http://www.securityfocus.com/archive/1/488971/100/0/threaded" }, { "name" : "http://www.gnucitizen.org/blog/web-mayhem-firefoxs-jar-protocol-issues", "refsource" : "MISC", "url" : "http://www.gnucitizen.org/blog/web-mayhem-firefoxs-jar-protocol-issues" }, { "name" : "http://bugs.gentoo.org/show_bug.cgi?id=198965", "refsource" : "MISC", "url" : "http://bugs.gentoo.org/show_bug.cgi?id=198965" }, { "name" : "http://bugs.gentoo.org/show_bug.cgi?id=200909", "refsource" : "MISC", "url" : "http://bugs.gentoo.org/show_bug.cgi?id=200909" }, { "name" : "http://www.mozilla.org/security/announce/2007/mfsa2007-37.html", "refsource" : "CONFIRM", "url" : "http://www.mozilla.org/security/announce/2007/mfsa2007-37.html" }, { "name" : "https://bugzilla.mozilla.org/show_bug.cgi?id=369814", "refsource" : "CONFIRM", "url" : "https://bugzilla.mozilla.org/show_bug.cgi?id=369814" }, { "name" : "https://issues.rpath.com/browse/RPL-1984", "refsource" : "CONFIRM", "url" : "https://issues.rpath.com/browse/RPL-1984" }, { "name" : "http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260", "refsource" : "CONFIRM", "url" : "http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260" }, { "name" : "http://browser.netscape.com/releasenotes/", "refsource" : "CONFIRM", "url" : "http://browser.netscape.com/releasenotes/" }, { "name" : "http://wiki.rpath.com/Advisories:rPSA-2008-0093", "refsource" : "CONFIRM", "url" : "http://wiki.rpath.com/Advisories:rPSA-2008-0093" }, { "name" : "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093", "refsource" : "CONFIRM", "url" : "http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093" }, { "name" : "https://issues.rpath.com/browse/RPL-1995", "refsource" : "CONFIRM", "url" : "https://issues.rpath.com/browse/RPL-1995" }, { "name" : "DSA-1424", "refsource" : "DEBIAN", "url" : "http://www.debian.org/security/2007/dsa-1424" }, { "name" : "DSA-1425", "refsource" : "DEBIAN", "url" : "http://www.debian.org/security/2007/dsa-1425" }, { "name" : "FEDORA-2007-3952", "refsource" : "FEDORA", "url" : "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html" }, { "name" : "FEDORA-2007-4098", "refsource" : "FEDORA", "url" : "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html" }, { "name" : "FEDORA-2007-4106", "refsource" : "FEDORA", "url" : "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html" }, { "name" : "FEDORA-2007-756", "refsource" : "FEDORA", "url" : "https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html" }, { "name" : "GLSA-200712-21", "refsource" : "GENTOO", "url" : "http://security.gentoo.org/glsa/glsa-200712-21.xml" }, { "name" : "HPSBUX02153", "refsource" : "HP", "url" : "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742" }, { "name" : "SSRT061181", "refsource" : "HP", "url" : "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742" }, { "name" : "MDKSA-2007:246", "refsource" : "MANDRIVA", "url" : "http://www.mandriva.com/security/advisories?name=MDKSA-2007:246" }, { "name" : "RHSA-2007:1082", "refsource" : "REDHAT", "url" : "http://www.redhat.com/support/errata/RHSA-2007-1082.html" }, { "name" : "RHSA-2007:1084", "refsource" : "REDHAT", "url" : "http://www.redhat.com/support/errata/RHSA-2007-1084.html" }, { "name" : "RHSA-2007:1083", "refsource" : "REDHAT", "url" : "http://www.redhat.com/support/errata/RHSA-2007-1083.html" }, { "name" : "SSA:2007-331-01", "refsource" : "SLACKWARE", "url" : "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833" }, { "name" : "SSA:2007-333-01", "refsource" : "SLACKWARE", "url" : "http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006" }, { "name" : "231441", "refsource" : "SUNALERT", "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1" }, { "name" : "1018977", "refsource" : "SUNALERT", "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1" }, { "name" : "SUSE-SA:2007:066", "refsource" : "SUSE", "url" : "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html" }, { "name" : "USN-546-1", "refsource" : "UBUNTU", "url" : "https://usn.ubuntu.com/546-1/" }, { "name" : "USN-546-2", "refsource" : "UBUNTU", "url" : "http://www.ubuntu.com/usn/usn-546-2" }, { "name" : "VU#715737", "refsource" : "CERT-VN", "url" : "http://www.kb.cert.org/vuls/id/715737" }, { "name" : "26385", "refsource" : "BID", "url" : "http://www.securityfocus.com/bid/26385" }, { "name" : "oval:org.mitre.oval:def:9873", "refsource" : "OVAL", "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9873" }, { "name" : "ADV-2007-3818", "refsource" : "VUPEN", "url" : "http://www.vupen.com/english/advisories/2007/3818" }, { "name" : "ADV-2007-4002", "refsource" : "VUPEN", "url" : "http://www.vupen.com/english/advisories/2007/4002" }, { "name" : "ADV-2007-4018", "refsource" : "VUPEN", "url" : "http://www.vupen.com/english/advisories/2007/4018" }, { "name" : "ADV-2008-0083", "refsource" : "VUPEN", "url" : "http://www.vupen.com/english/advisories/2008/0083" }, { "name" : "ADV-2008-0643", "refsource" : "VUPEN", "url" : "http://www.vupen.com/english/advisories/2008/0643" }, { "name" : "1018928", "refsource" : "SECTRACK", "url" : "http://www.securitytracker.com/id?1018928" }, { "name" : "27605", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27605" }, { "name" : "27793", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27793" }, { "name" : "27796", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27796" }, { "name" : "27797", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27797" }, { "name" : "27816", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27816" }, { "name" : "27944", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27944" }, { "name" : "27957", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27957" }, { "name" : "28001", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/28001" }, { "name" : "28016", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/28016" }, { "name" : "27955", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27955" }, { "name" : "28171", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/28171" }, { "name" : "28277", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/28277" }, { "name" : "27800", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27800" }, { "name" : "27838", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27838" }, { "name" : "27845", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27845" }, { "name" : "28398", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/28398" }, { "name" : "27855", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27855" }, { "name" : "27979", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/27979" }, { "name" : "29164", "refsource" : "SECUNIA", "url" : "http://secunia.com/advisories/29164" }, { "name" : "firefox-jar-uri-xss(38356)", "refsource" : "XF", "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/38356" } ] } }