{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-07-25T00:00:00", "descriptions": [{"lang": "en", "value": "Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-15T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://larholm.com/2007/07/25/mozilla-protocol-abuse/"}, {"name": "20070726 Re: Mozilla protocol abuse", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/474686/100/0/threaded"}, {"name": "20070725 Mozilla protocol abuse", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/474624/100/0/threaded"}, {"name": "20070725 Mozilla protocol abuse", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2007/Jul/0557.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4038", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://larholm.com/2007/07/25/mozilla-protocol-abuse/", "refsource": "MISC", "url": "http://larholm.com/2007/07/25/mozilla-protocol-abuse/"}, {"name": "20070726 Re: Mozilla protocol abuse", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/474686/100/0/threaded"}, {"name": "20070725 Mozilla protocol abuse", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/474624/100/0/threaded"}, {"name": "20070725 Mozilla protocol abuse", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2007/Jul/0557.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:37:06.120Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://larholm.com/2007/07/25/mozilla-protocol-abuse/"}, {"name": "20070726 Re: Mozilla protocol abuse", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/474686/100/0/threaded"}, {"name": "20070725 Mozilla protocol abuse", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/474624/100/0/threaded"}, {"name": "20070725 Mozilla protocol abuse", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2007/Jul/0557.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4038", "datePublished": "2007-07-27T22:00:00", "dateReserved": "2007-07-27T00:00:00", "dateUpdated": "2024-08-07T14:37:06.120Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "C99BB6C8-1877-4B70-B6EF-952E200ABABE", "versionEndIncluding": "2.0.0.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:*", "matchCriteriaId": "4FB87608-0DF8-4729-95C5-CFA386AB3AC2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de argumentos en Mozilla Firefox versiones anteriores a 2.0.0.5, cuando se ejecuta en sistemas con Thunderbird versi\u00f3n 1.5 instalado y ciertas URI registradas, permite a atacantes remotos conducir ataques de tipo cross-browser scripting y ejecutar comandos arbitrarios por medio de metacaracteres shell en una URI mailto, que se insertan en la l\u00ednea de comandos que es creada al invocar el archivo Thunderbird.exe, un problema similar a CVE-2007-3670."}], "id": "CVE-2007-4038", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-07-27T22:30:00.000", "references": [{"source": "cve@mitre.org", "url": "http://larholm.com/2007/07/25/mozilla-protocol-abuse/"}, {"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2007/Jul/0557.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/474624/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/474686/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://larholm.com/2007/07/25/mozilla-protocol-abuse/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2007/Jul/0557.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/474624/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/474686/100/0/threaded"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Not vulnerable. This issue does not affect the versions of Firefox or Thunderbird as shipped with Red Hat Enterprise Linux.", "lastModified": "2007-07-31T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}