Description
Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid "%" encoding, related to improper file type handling on Windows XP with Internet Explorer 7 installed, a variant of CVE-2007-3845.
References
- 27414 third-party-advisory
- HPSBUX02156 vendor-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-36.html
- 27360 third-party-advisory
- HPSBUX02153 vendor-advisory
- 27315 third-party-advisory
- 25543 vdb-entry
- ADV-2007-3544 vdb-entry
- SSA:2007-324-01 vendor-advisory
- ADV-2008-0083 vdb-entry
- http://xs-sniper.com/blog/2007/09/01/firefox-file-handling-woes/
- 27744 third-party-advisory
- ADV-2008-0082 vdb-entry
- 28398 third-party-advisory
- 27311 third-party-advisory
- MDKSA-2007:202 vendor-advisory
- 28363 third-party-advisory