CVE-2007-5947
CVE-2007-5947
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://browser.netscape.com/releasenotes/http://bugs.gentoo.org/show_bug.cgi?id=198965http://bugs.gentoo.org/show_bug.cgi?id=200909http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=369814http://secunia.com/advisories/27605http://secunia.com/advisories/27793http://secunia.com/advisories/27796http://secunia.com/advisories/27797http://secunia.com/advisories/27800http://secunia.com/advisories/27816