CVE - CVE-2007-0996

CVE-ID
CVE-2007-0996	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:1017702 URL:http://www.securitytracker.com/id?1017702 MISC:20070202-01-P URL:ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc MISC:20070223 Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability URL:http://www.securityfocus.com/archive/1/461076/100/0/threaded MISC:20070226 rPSA-2007-0040-1 firefox URL:http://www.securityfocus.com/archive/1/461336/100/0/threaded MISC:20070301-01-P URL:ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc MISC:22694 URL:http://www.securityfocus.com/bid/22694 MISC:24205 URL:http://secunia.com/advisories/24205 MISC:24287 URL:http://secunia.com/advisories/24287 MISC:24290 URL:http://secunia.com/advisories/24290 MISC:24320 URL:http://secunia.com/advisories/24320 MISC:24328 URL:http://secunia.com/advisories/24328 MISC:24333 URL:http://secunia.com/advisories/24333 MISC:24342 URL:http://secunia.com/advisories/24342 MISC:24343 URL:http://secunia.com/advisories/24343 MISC:24384 URL:http://secunia.com/advisories/24384 MISC:24395 URL:http://secunia.com/advisories/24395 MISC:24455 URL:http://secunia.com/advisories/24455 MISC:24457 URL:http://secunia.com/advisories/24457 MISC:24650 URL:http://secunia.com/advisories/24650 MISC:25588 URL:http://secunia.com/advisories/25588 MISC:33812 URL:~~http://osvdb.org/33812~~ (Obsolete source) MISC:ADV-2007-0718 URL:~~http://www.vupen.com/english/advisories/2007/0718~~ (Obsolete source) MISC:DSA-1336 URL:http://www.debian.org/security/2007/dsa-1336 MISC:FEDORA-2007-281 URL:http://fedoranews.org/cms/node/2713 MISC:FEDORA-2007-293 URL:http://fedoranews.org/cms/node/2728 MISC:HPSBUX02153 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 MISC:MDKSA-2007:050 URL:~~http://www.mandriva.com/security/advisories?name=MDKSA-2007:050~~ (Obsolete source) MISC:RHSA-2007:0077 URL:http://rhn.redhat.com/errata/RHSA-2007-0077.html MISC:RHSA-2007:0078 URL:http://www.redhat.com/support/errata/RHSA-2007-0078.html MISC:RHSA-2007:0079 URL:http://www.redhat.com/support/errata/RHSA-2007-0079.html MISC:RHSA-2007:0097 URL:http://www.redhat.com/support/errata/RHSA-2007-0097.html MISC:RHSA-2007:0108 URL:http://www.redhat.com/support/errata/RHSA-2007-0108.html MISC:SSA:2007-066-03 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851 MISC:SSA:2007-066-05 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131 MISC:SSRT061181 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 MISC:SUSE-SA:2007:019 URL:http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html MISC:SUSE-SA:2007:022 URL:http://www.novell.com/linux/security/advisories/2007_22_mozilla.html MISC:USN-428-1 URL:http://www.ubuntu.com/usn/usn-428-1 MISC:http://www.hardened-php.net/advisory_032007.142.html URL:http://www.hardened-php.net/advisory_032007.142.html MISC:http://www.mozilla.org/security/announce/2007/mfsa2007-02.html URL:http://www.mozilla.org/security/announce/2007/mfsa2007-02.html MISC:https://issues.rpath.com/browse/RPL-1103 URL:https://issues.rpath.com/browse/RPL-1103 MISC:oval:org.mitre.oval:def:10086 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10086
Assigning CNA
Red Hat, Inc.
Date Record Created
20070216	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070216)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)