CVE-2007-3736: XSS

Published Jul 18, 2007

Updated

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.

Affected Software

5 affected components

Mozilla Firefox=2.0.0.2

Mozilla Firefox=2.0

Mozilla Firefox=2.0.0.3

Mozilla Firefox=2.0.0.4

Mozilla Firefox=2.0.0.1

Remediation

Patch Available

http://secunia.com/advisories/26095

Event History

Jul 18, 2007

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

Which Firefox versions are affected?

Mozilla Firefox versions before 2.0.0.5 are affected. A patch is available.

What must an attacker do to exploit this issue?

An attacker must remotely trigger a timing issue involving addEventListener or setTimeout so that an event activates after the browsing context has changed. This can allow injected script to execute in another site's context.

Is authentication required for exploitation?

No. The supplied vector specifies that no authentication is required, although exploitation has medium access complexity.

CVE-2007-3736: XSS

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Which Firefox versions are affected?

What must an attacker do to exploit this issue?

Is authentication required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Firefox versions are affected?

What must an attacker do to exploit this issue?

Is authentication required for exploitation?