CVE-2007-1562: canonical ubuntu_linux

Modified

Published 21-03-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-1562 is a medium (CVSS 6.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 14.27% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 21-03-2007)

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

14.27%

0%100%

Medium · +0.42 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2007:0400 RHSA-2007:0402

Timeline

21-03-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

14.27%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

Increase +0.42 pp

From 13.85% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databaseremotelinuxVerified
Mozilla FireFox 1.5.x/2.0 - FTP PASV Port-Scanning
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Canonical1 product

ubuntu_linuxEOL5.10 | 6.06 | 6.10

Mozilla1 product

firefox≥ 1.5, < 1.5.0.11 | ≥ 2.0, < 2.0.0.3

2 vendors · 2 products

References

21 links

www.ubuntu.com/usn/usn-443-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.securityfocus.com/archive/1/470172/100/200/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
exchange.xforce.ibmcloud.com/vulnerabilities/33119VDB EntryX Refsource XFThird Party Advisory
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Vendor AdvisoryX Refsource HPBroken Link
www.securitytracker.com/id?1017800VDB EntryX Refsource SECTRACKThird Party Advisory
www.novell.com/linux/security/advisories/2007_36_mozilla.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.redhat.com/support/errata/RHSA-2007-0400.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/archive/1/463501/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2007/1034VDB EntryX Refsource VUPENThird Party Advisory
bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdfX Refsource MISCBroken Link

Show all 21 references

www.securityfocus.com/bid/23082VDB EntryX Refsource BIDThird Party Advisory
issues.rpath.com/browse/RPL-1424X Refsource CONFIRMBroken Link
secunia.com/advisories/25858Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25476Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/security/announce/2007/mfsa2007-11.htmlX Refsource CONFIRMVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11431VDB EntrySignatureX Refsource OVALThird Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=370559X Refsource MISCIssue TrackingVendor Advisory
secunia.com/advisories/25490Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-0402.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
issues.rpath.com/browse/RPL-1157X Refsource CONFIRMBroken Link
www.openwall.com/lists/oss-security/2020/12/09/1Mailing ListX Refsource MLIST