PT-2007-5249

CVE-2007-4041

Published

2007-07-27

Updated

2021-07-23

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 2.0.0.5 and 3.0alpha

Description: The issue allows remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a mailto, nntp, news, snews, or telnet URI.

Recommendations: For Mozilla Firefox version 2.0.0.5, update to a version that contains a fix for this issue. For Mozilla Firefox version 3.0alpha, update to a version that contains a fix for this issue.

Exploitability

Fix

Impacts

Researchers

Daniel Veditz

Dveditz

Juergen Schmidt

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers