CVE-2007-4879

NameCVE-2007-4879
DescriptionMozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1532-1, DSA-1534-1, DSA-1534-2, DSA-1535-1
NVD severitymedium (attack range: remote)
Debian Bugs444803, 444805

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
iceweasel (PTS)wheezy (security), wheezy38.8.0esr-1~deb7u1fixed
jessie (security)38.8.0esr-1~deb8u1fixed
xulrunner (PTS)wheezy (security), wheezy24.8.1esr-2~deb7u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
iceapesource(unstable)1.1.9-1low444805
iceapesourceetch1.0.13~pre080323b-0etch2mediumDSA-1534-2
iceweaselsource(unstable)2.0.0.13-1low444803
iceweaselsourceetch2.0.0.13-0etch1mediumDSA-1535-1
xulrunnersource(unstable)1.8.1.13-1medium
xulrunnersourceetch1.8.0.15~pre080323b-0etch1mediumDSA-1532-1

Search for package or bug name: Reporting problems