CVE-2007-1256: Buffer Overflow

Published Mar 3, 2007

Updated

Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092.

Affected Software

3 affected components

Mozilla Firefox=2.0

Mozilla Firefox=2.0.0.1

Mozilla Firefox=2.0.0.2

Event History

Mar 3, 2007

CVE Published

08:19 PM

Mar 4, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1256?

CVE-2007-1256 is classified as a medium severity vulnerability.

How do I fix CVE-2007-1256?

To mitigate CVE-2007-1256, users should upgrade to a version of Mozilla Firefox that is newer than 2.0.0.2.

What exploit methods are used in CVE-2007-1256?

CVE-2007-1256 can be exploited by attackers to spoof the address bar and favicons through the misuse of document.location in the onunload attribute.

What versions of Mozilla Firefox are affected by CVE-2007-1256?

CVE-2007-1256 affects Mozilla Firefox versions 2.0, 2.0.0.1, and 2.0.0.2.

Is user interaction required to exploit CVE-2007-1256?

Yes, user interaction is typically required to trigger the exploit of CVE-2007-1256.