CVE-2007-0778: Infoleak
First published: Mon Feb 26 2007(Updated: )
The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | >=1.5<1.5.0.10 | |
| Firefox | >=2.0<2.0.0.2 | |
| Mozilla SeaMonkey | <1.0.8 | |
| Ubuntu | =6.06 | |
| Ubuntu | =6.10 | |
| Ubuntu | =5.10 | |
| Debian Linux | =3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.mozilla.org/security/announce/2007/mfsa2007-03.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=347852
- https://issues.rpath.com/browse/RPL-1081
- https://issues.rpath.com/browse/RPL-1103
- http://fedoranews.org/cms/node/2713
- http://fedoranews.org/cms/node/2728
- http://security.gentoo.org/glsa/glsa-200703-04.xml
- http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml
- http://www.redhat.com/support/errata/RHSA-2007-0079.html
- http://rhn.redhat.com/errata/RHSA-2007-0077.html
- http://www.redhat.com/support/errata/RHSA-2007-0078.html
- http://www.redhat.com/support/errata/RHSA-2007-0097.html
- http://www.redhat.com/support/errata/RHSA-2007-0108.html
- http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
- http://www.ubuntu.com/usn/usn-428-1
- http://www.securityfocus.com/bid/22694
- http://www.osvdb.org/32110
- http://securitytracker.com/id?1017699
- http://secunia.com/advisories/24238
- http://secunia.com/advisories/24287
- http://secunia.com/advisories/24290
- http://secunia.com/advisories/24205
- http://secunia.com/advisories/24328
- http://secunia.com/advisories/24333
- http://secunia.com/advisories/24343
- http://secunia.com/advisories/24320
- http://secunia.com/advisories/24293
- http://secunia.com/advisories/24393
- http://secunia.com/advisories/24395
- http://secunia.com/advisories/24384
- http://secunia.com/advisories/24437
- http://secunia.com/advisories/24650
- http://www.debian.org/security/2007/dsa-1336
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
- http://www.novell.com/linux/security/advisories/2007_22_mozilla.html
- http://secunia.com/advisories/24455
- http://secunia.com/advisories/24457
- http://secunia.com/advisories/24342
- http://secunia.com/advisories/25588
- http://www.vupen.com/english/advisories/2007/0718
- http://www.vupen.com/english/advisories/2008/0083
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
- https://exchange.xforce.ibmcloud.com/vulnerabilities/32671
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9151
- http://www.securityfocus.com/archive/1/461809/100/0/threaded
- http://www.securityfocus.com/archive/1/461336/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-0778?
CVE-2007-0778 has a moderate severity rating due to its potential to leak sensitive information.
How do I fix CVE-2007-0778?
To fix CVE-2007-0778, update Mozilla Firefox to version 1.5.0.10 or later, or upgrade to version 2.0.0.2 or later.
Which versions of Firefox are affected by CVE-2007-0778?
CVE-2007-0778 affects Mozilla Firefox versions prior to 1.5.0.10 and 2.x versions prior to 2.0.0.2.
Which other software is affected by CVE-2007-0778?
In addition to Firefox, SeaMonkey versions before 1.0.8 and specific versions of Ubuntu and Debian Linux are also impacted by CVE-2007-0778.
What types of attacks could result from CVE-2007-0778?
CVE-2007-0778 could allow remote attackers to exploit hash collisions to obtain sensitive information or facilitate further attacks.
- agent/references
- agent/type
- agent/author
- agent/severity
- agent/weakness
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/mozilla
- canonical/firefox
- version/firefox/1.5
- version/firefox/2.0
- canonical/mozilla seamonkey
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/6.06
- version/ubuntu/6.10
- version/ubuntu/5.10
- vendor/debian
- canonical/debian linux
- version/debian linux/3.1