Name | CVE-2007-1084 |
Description | Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page. |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Debian Bugs | 556268, 556270, 556271, 556272 |
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|---|---|---|
epiphany-browser (PTS) | bullseye (security), bullseye | 3.38.2-1+deb11u3 | vulnerable |
bookworm | 43.1-1 | vulnerable | |
sid, trixie | 47.0-1 | vulnerable |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|---|---|---|---|---|---|
conkeror | source | (unstable) | (not affected) | |||
epiphany-browser | source | (unstable) | (unfixed) | unimportant | 556272 | |
galeon | source | (unstable) | 2.0.7-2 | unimportant | 556270 | |
iceape | source | (unstable) | (unfixed) | unimportant | ||
iceweasel | source | (unstable) | (unfixed) | unimportant | 556268 | |
kazehakase | source | lenny | 0.5.4-2lenny1 | |||
kazehakase | source | (unstable) | 0.5.8-2 | 556271 | ||
webkit | source | (unstable) | (not affected) |
only epiphany-gecko backend affected
- conkeror <not-affected> (doesn't support bookmarks)
- webkit <not-affected> (doesn't support javascript embedded in bookmarks)