CVE-2007-3844: mozilla firefox

Modified

Published 08-08-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-3844 is a medium (CVSS 4.3) vulnerability in mozilla firefox. EPSS estimates a 5.45% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 31-07-2007)

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

5.45%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 11

DSA-1344-1 DSA-1345-1 DSA-1346-1 DSA-1391-1 DTSA-51-1 DTSA-52-1+5 more

Timeline

08-08-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

5.45%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.45% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databaseremotelinuxVerified
Mozilla Firefox/Thunderbird/SeaMonkey - Chrome-Loaded About:Blank Script Execution
Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Mozilla3 products

firefox2.0.0.5
seamonkey1.1.3
thunderbird2.0.0.5

1 vendor · 3 products

References

55 links

www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.htmlVendor AdvisoryX Refsource FEDORA
issues.rpath.com/browse/RPL-1600X Refsource CONFIRM
www.ubuntu.com/usn/usn-503-1Vendor AdvisoryX Refsource UBUNTU
www.mandriva.com/security/advisories?name=MDVSA-2008:047Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2007/3587VDB EntryX Refsource VUPEN
secunia.com/advisories/27414Third Party AdvisoryX Refsource SECUNIA
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579Vendor AdvisoryX Refsource HP
bugzilla.mozilla.org/show_bug.cgi?id=388121X Refsource CONFIRM
secunia.com/advisories/26393Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26303Third Party AdvisoryX Refsource SECUNIA

Show all 55 references

www.vupen.com/english/advisories/2007/4256VDB EntryX Refsource VUPEN
secunia.com/advisories/26309Third Party AdvisoryX Refsource SECUNIA
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Vendor AdvisoryX Refsource HP
secunia.com/advisories/27298Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:152Vendor AdvisoryX Refsource MANDRIVA
www.gentoo.org/security/en/glsa/glsa-200708-09.xmlVendor AdvisoryX Refsource GENTOO
securitytracker.com/id?1018481VDB EntryX Refsource SECTRACKPatch
www.debian.org/security/2007/dsa-1345Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/26288Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
secunia.com/advisories/27327Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27276Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2007/dsa-1391Vendor AdvisoryX Refsource DEBIAN
www.debian.org/security/2007/dsa-1346Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/support/errata/RHSA-2007-0980.htmlVendor AdvisoryX Refsource REDHAT
www.novell.com/linux/security/advisories/2007_57_mozilla.htmlVendor AdvisoryX Refsource SUSE
www.mandriva.com/security/advisories?name=MDVSA-2007:047Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/28135Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27356Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-0981.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/bid/25142VDB EntryX Refsource BIDExploitPatch
www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.htmlVendor AdvisoryX Refsource FEDORA
www.mozilla.org/security/announce/2007/mfsa2007-26.htmlX Refsource CONFIRMPatch
www.vupen.com/english/advisories/2008/0082VDB EntryX Refsource VUPEN
sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1Vendor AdvisoryX Refsource SUNALERT
www.ubuntu.com/usn/usn-493-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/26234Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2007/dsa-1344Vendor AdvisoryX Refsource DEBIAN
securitytracker.com/id?1018480VDB EntryX Refsource SECTRACK
secunia.com/advisories/27325Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-0979.htmlVendor AdvisoryX Refsource REDHAT
securitytracker.com/id?1018479VDB EntryX Refsource SECTRACK
secunia.com/advisories/26258Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27326Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/28363Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26331Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26460Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27680Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/475265/100/200/threadedMailing ListX Refsource BUGTRAQ
support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.htmlX Refsource CONFIRM
sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1Vendor AdvisoryX Refsource SUNALERT
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9493VDB EntrySignatureX Refsource OVAL
www.securityfocus.com/archive/1/475450/30/5550/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/26335Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26572Third Party AdvisoryX Refsource SECUNIA
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.010101Vendor AdvisoryX Refsource SLACKWARE