CVE-2007-3845: mozilla firefox

Modified

Published 08-08-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-3845 is a high (CVSS 9.3) vulnerability in mozilla firefox. EPSS estimates a 5.70% chance of exploitation in the next 30 days, higher than 93% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 25-07-2007)

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

5.70%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 8

DSA-1344-1 DSA-1345-1 DSA-1346-1 DSA-1391-1 DTSA-51-1 DTSA-52-1+2 more

Timeline

08-08-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler."

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

5.70%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.70% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databaseremotewindowsVerified
Multiple Browsers - URI Handlers Command Injection
Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Mozilla3 products

firefox2.0.0.5
seamonkey1.1.3
thunderbird2.0.0.5

1 vendor · 3 products

References

34 links

www.mozilla.org/security/announce/2007/mfsa2007-27.htmlX Refsource CONFIRM
issues.rpath.com/browse/RPL-1600X Refsource CONFIRM
www.ubuntu.com/usn/usn-503-1Vendor AdvisoryX Refsource UBUNTU
www.mandriva.com/security/advisories?name=MDVSA-2008:047Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27414Third Party AdvisoryX Refsource SECUNIA
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579Vendor AdvisoryX Refsource HP
secunia.com/advisories/26393Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26303Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/4256VDB EntryX Refsource VUPEN
www.securityfocus.com/bid/25053VDB EntryX Refsource BID

Show all 34 references

secunia.com/advisories/26309Third Party AdvisoryX Refsource SECUNIA
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Vendor AdvisoryX Refsource HP
www.mandriva.com/security/advisories?name=MDKSA-2007:152Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2007/dsa-1345Vendor AdvisoryX Refsource DEBIAN
www.debian.org/security/2007/dsa-1391Vendor AdvisoryX Refsource DEBIAN
bugzilla.mozilla.org/show_bug.cgi?id=389580X Refsource CONFIRM
www.debian.org/security/2007/dsa-1346Vendor AdvisoryX Refsource DEBIAN
bugzilla.mozilla.org/show_bug.cgi?id=389106X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2007:047Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/28135Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0082VDB EntryX Refsource VUPEN
sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1Vendor AdvisoryX Refsource SUNALERT
www.ubuntu.com/usn/usn-493-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/26234Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2007/dsa-1344Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/26258Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27326Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26331Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/475265/100/200/threadedMailing ListX Refsource BUGTRAQ
sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1Vendor AdvisoryX Refsource SUNALERT
www.securityfocus.com/archive/1/475450/30/5550/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/26335Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26572Third Party AdvisoryX Refsource SECUNIA
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.010101Vendor AdvisoryX Refsource SLACKWARE