4.3
CVSSv2

CVE-2007-2292

Published: 26/04/2007 Updated: 23/07/2021
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox prior to 2.0.0.8 and SeaMonkey prior to 1.1.5 allows remote malicious users to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.

Vulnerable Product Search on Vulmon Subscribe to Product

mozilla firefox

mozilla seamonkey

microsoft internet explorer 7.0.5730.11

Vendor Advisories

Debian Bug report logs - #447734 libxul0d: vulnerable to CVE-2007-5339 Package: libxul0d; Maintainer for libxul0d is (unknown); Reported by: Sam Morris <sam@robotsorguk> Date: Tue, 23 Oct 2007 13:18:01 UTC Severity: grave Tags: security Found in versions xulrunner/1816-1, xulrunner/18011-2 Fixed in versions xulrun ...
Various flaws were discovered in the layout and JavaScript engines By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user’s privileges (CVE-2007-5336, CVE-2007-5339, CVE-2007-5340) ...
Various flaws were discovered in the layout and JavaScript engines By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user’s privileges (CVE-2007-5339, CVE-2007-5340) ...
Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-1095 Michal Zalewski discovered that the unload event handler had access to the address of the next page to be load ...
Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the Seamonkey Internet Suite The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-1095 Michal Zalewski discovered that the unload event handler had access to the address of the next page t ...
Mozilla Foundation Security Advisory 2007-31 Digest authentication request splitting Announced October 18, 2007 Reporter Stefano Di Paola Impact Moderate Products Firefox, SeaMonkey Fixed in ...

References

CWE-20http://www.wisec.it/vulns.php?id=11http://www.securityfocus.com/bid/23668http://www.securitytracker.com/id?1017968https://bugzilla.mozilla.org/show_bug.cgi?id=378787http://www.mozilla.org/security/announce/2007/mfsa2007-31.htmlhttps://issues.rpath.com/browse/RPL-1858http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.htmlhttp://www.debian.org/security/2007/dsa-1396http://www.debian.org/security/2007/dsa-1401http://www.debian.org/security/2007/dsa-1392https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.htmlhttps://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.htmlhttp://www.gentoo.org/security/en/glsa/glsa-200711-14.xmlhttp://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202http://www.redhat.com/support/errata/RHSA-2007-0979.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0980.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0981.htmlhttp://www.novell.com/linux/security/advisories/2007_57_mozilla.htmlhttp://www.ubuntu.com/usn/usn-536-1http://secunia.com/advisories/27276http://secunia.com/advisories/27325http://secunia.com/advisories/27327http://secunia.com/advisories/27335http://secunia.com/advisories/27356http://secunia.com/advisories/27383http://secunia.com/advisories/27425http://secunia.com/advisories/27403http://secunia.com/advisories/27480http://secunia.com/advisories/27387http://secunia.com/advisories/27298http://secunia.com/advisories/27311http://secunia.com/advisories/27315http://secunia.com/advisories/27336http://secunia.com/advisories/27665http://secunia.com/advisories/27414http://securityreason.com/securityalert/2654https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.htmlhttp://secunia.com/advisories/27680http://secunia.com/advisories/27360http://secunia.com/advisories/28398http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742http://www.vupen.com/english/advisories/2007/3544http://www.vupen.com/english/advisories/2007/3587http://www.vupen.com/english/advisories/2008/0083https://exchange.xforce.ibmcloud.com/vulnerabilities/33981https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10195https://usn.ubuntu.com/535-1/http://www.securityfocus.com/archive/1/482932/100/200/threadedhttp://www.securityfocus.com/archive/1/482925/100/0/threadedhttp://www.securityfocus.com/archive/1/482876/100/200/threadedhttp://www.securityfocus.com/archive/1/466906/100/0/threadedhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447734https://nvd.nist.govhttps://usn.ubuntu.com/535-1/