CVE-2007-0996
- State
- Published
- Severity
- Not scored
- Published
- Feb 27, 2007
- Updated
- Aug 7, 2024
- Reserved
- Feb 16, 2007
Description
The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2007:0078vendor-advisory
- 24395third-party-advisory
- oval:org.mitre.oval:def:10086vdb-entrysignature
- 20070226 rPSA-2007-0040-1 firefoxmailing-list
- 24328third-party-advisory
- RHSA-2007:0108vendor-advisory
- SSA:2007-066-03vendor-advisory
- 24384third-party-advisory
- 24457third-party-advisory
- 24343third-party-advisory
- DSA-1336vendor-advisory
- HPSBUX02153vendor-advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
- ADV-2007-0718vdb-entry
- 24650third-party-advisory
- USN-428-1vendor-advisory
- 24320third-party-advisory
- 25588third-party-advisory
- https://issues.rpath.com/browse/RPL-1103
- SUSE-SA:2007:019vendor-advisory
- SUSE-SA:2007:022vendor-advisory
- 24342third-party-advisory
- 24287third-party-advisory
- 20070223 Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerabilitymailing-list
- http://www.hardened-php.net/advisory_032007.142.html
- 22694vdb-entry
- FEDORA-2007-281vendor-advisory
- RHSA-2007:0097vendor-advisory
- 1017702vdb-entry
- FEDORA-2007-293vendor-advisory
- 24205third-party-advisory
- 24333third-party-advisory
- 33812vdb-entry
- MDKSA-2007:050vendor-advisory
- 24290third-party-advisory
- 24455third-party-advisory
- RHSA-2007:0077vendor-advisory
- SSA:2007-066-05vendor-advisory
- RHSA-2007:0079vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.