CVE-2007-5960

Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.

Link	Resource
http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
http://www.debian.org/security/2007/dsa-1424
http://www.debian.org/security/2007/dsa-1425
http://www.redhat.com/support/errata/RHSA-2007-1082.html	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-1084.html	Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html
http://www.ubuntu.com/usn/usn-546-2
http://www.securityfocus.com/bid/26589
http://securitytracker.com/id?1018995
http://secunia.com/advisories/27725	Vendor Advisory
http://secunia.com/advisories/27793	Vendor Advisory
http://secunia.com/advisories/27796	Vendor Advisory
http://secunia.com/advisories/27797	Vendor Advisory
http://secunia.com/advisories/27816	Vendor Advisory
http://secunia.com/advisories/27944	Vendor Advisory
http://secunia.com/advisories/27957	Vendor Advisory
http://secunia.com/advisories/28001	Vendor Advisory
http://bugs.gentoo.org/show_bug.cgi?id=198965
http://bugs.gentoo.org/show_bug.cgi?id=200909
https://issues.rpath.com/browse/RPL-1984
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
http://security.gentoo.org/glsa/glsa-200712-21.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:246
http://www.redhat.com/support/errata/RHSA-2007-1083.html	Vendor Advisory
http://secunia.com/advisories/28016	Vendor Advisory
http://secunia.com/advisories/27955	Vendor Advisory
http://secunia.com/advisories/28171	Vendor Advisory
http://secunia.com/advisories/28277	Vendor Advisory
http://browser.netscape.com/releasenotes/
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006
http://secunia.com/advisories/27800	Vendor Advisory
http://secunia.com/advisories/27838	Vendor Advisory
http://secunia.com/advisories/27845	Vendor Advisory
http://secunia.com/advisories/28398	Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html
http://secunia.com/advisories/27855	Vendor Advisory
http://secunia.com/advisories/27979	Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1
http://wiki.rpath.com/Advisories:rPSA-2008-0093
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
https://issues.rpath.com/browse/RPL-1995
http://secunia.com/advisories/29164
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1
http://www.vupen.com/english/advisories/2007/4002
http://www.vupen.com/english/advisories/2008/0083
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://www.vupen.com/english/advisories/2007/4018
http://www.vupen.com/english/advisories/2008/0643
https://exchange.xforce.ibmcloud.com/vulnerabilities/38644
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794
https://usn.ubuntu.com/546-1/
http://www.securityfocus.com/archive/1/488971/100/0/threaded
http://www.securityfocus.com/archive/1/488002/100/0/threaded

Configuration 1

cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:* cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*

---

Published : 2007-11-26 11:46

Updated : 2023-02-13 02:18

---

NVD link : CVE-2007-5960

Mitre link : CVE-2007-5960

No products.

CWE-22