CVE-2007-0994: Code Injection
A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0994?
CVE-2007-0994 has been classified as critical due to its ability to allow remote attackers to execute arbitrary JavaScript.
How do I fix CVE-2007-0994?
To fix CVE-2007-0994, users should update Mozilla Firefox to version 2.0.0.2 or later, or SeaMonkey to version 1.1.1 or later.
Which software is affected by CVE-2007-0994?
CVE-2007-0994 affects Mozilla Firefox versions prior to 2.0.0.2 and 1.x prior to 1.5.0.10, and SeaMonkey versions prior to 1.1.1 and 1.0.8.
Can CVE-2007-0994 affect Debian systems?
Yes, CVE-2007-0994 can affect Debian GNU/Linux versions specifically version 3.1.
What types of tags are exploited in CVE-2007-0994?
CVE-2007-0994 exploits javascript: URIs in img, link, or style tags within HTML mail messages.