Description
Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceweasel | 2.0.0.5-0etch1 | DSA-1338-1 |
Advisories 1
- DSA-1338-1 iceweasel Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://larholm.com/2007/07/25/mozilla-protocol-abuse/
- 20070726 Re: Mozilla protocol abuse mailing-list
- 20070725 Mozilla protocol abuse mailing-list
- 20070725 Mozilla protocol abuse mailing-list