CVE-2007-3736: XSS
Published Jul 18, 2007
·Updated
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.
Affected Software
5 affected components
Mozilla Firefox=2.0.0.2
Mozilla Firefox=2.0
Mozilla Firefox=2.0.0.3
Mozilla Firefox=2.0.0.4
Mozilla Firefox=2.0.0.1
Remediation
Patch Available
Event History
Jul 18, 2007
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
Which Firefox versions are affected?
Mozilla Firefox versions before 2.0.0.5 are affected. A patch is available.
2
What must an attacker do to exploit this issue?
An attacker must remotely trigger a timing issue involving addEventListener or setTimeout so that an event activates after the browsing context has changed. This can allow injected script to execute in another site's context.
3
Is authentication required for exploitation?
No. The supplied vector specifies that no authentication is required, although exploitation has medium access complexity.