CVE Feed

    Dashboard / CVE / CVE-2007-3845

    CVE-2007-3845

    Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler."

    Published:Aug 8, 2007
    Last Modified:Apr 23, 2026
    EPS:Aug 8, 2007
    EPSS Score:0.44107
    CVSS Score:8.8

    Affected Products

    Vendor
    Microsoft
    Product
    Windows Xp
    Vendor
    Mozilla
    Product
    Firefox
    Vendor
    Mozilla
    Product
    Seamonkey
    Vendor
    Mozilla
    Product
    Thunderbird

    Exploits

    https://www.exploit-db.com/exploits/30381

    Related CVEs

    CVE-2019-5620 (CVSS 9.8) — ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical…
    CVE-2020-7485 (CVSS 9.8) — **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy support account in the TriStation software version v4.9.0 and…
    CVE-2020-7484 (CVSS 7.5) — **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability with the former 'password' feature could allow a denia…
    CVE-2020-7483 (CVSS 7.5) — **VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause certain data to be visible on the network …
    CVE-2012-5362 (CVSS 7.5) — The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of servic…
    CVE-2012-5364 (CVSS 7.5) — The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of servic…
    CVE-2014-9748 (CVSS 8.1) — The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly…
    CVE-2019-1489 (CVSS 7.5) — An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properl…
    CVE-2017-14010 (CVSS 7.8) — In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled se…
    CVE-2018-5457 (CVSS 7) — A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with…

    References

    http://bugzilla.mozilla.org/show_bug.cgi?id=389580
    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579
    http://secunia.com/advisories/26234
    http://secunia.com/advisories/26258
    http://secunia.com/advisories/26303
    http://secunia.com/advisories/26309
    http://secunia.com/advisories/26331
    http://secunia.com/advisories/26335
    http://secunia.com/advisories/26393
    http://secunia.com/advisories/26572
    http://secunia.com/advisories/27326
    http://secunia.com/advisories/27414
    http://secunia.com/advisories/28135
    http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.010101
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
    http://www.debian.org/security/2007/dsa-1344
    http://www.debian.org/security/2007/dsa-1345
    http://www.debian.org/security/2007/dsa-1346
    http://www.debian.org/security/2007/dsa-1391
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:152
    http://www.mandriva.com/security/advisories?name=MDVSA-2007:047
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:047
    http://www.mozilla.org/security/announce/2007/mfsa2007-27.html
    http://www.securityfocus.com/archive/1/475265/100/200/threaded
    http://www.securityfocus.com/archive/1/475450/30/5550/threaded
    http://www.securityfocus.com/bid/25053
    http://www.ubuntu.com/usn/usn-493-1
    http://www.ubuntu.com/usn/usn-503-1
    http://www.vupen.com/english/advisories/2007/4256
    http://www.vupen.com/english/advisories/2008/0082
    https://bugzilla.mozilla.org/show_bug.cgi?id=389106
    https://issues.rpath.com/browse/RPL-1600
    http://bugzilla.mozilla.org/show_bug.cgi?id=389580
    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
    http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579
    http://secunia.com/advisories/26234
    http://secunia.com/advisories/26258
    http://secunia.com/advisories/26303
    http://secunia.com/advisories/26309
    http://secunia.com/advisories/26331
    http://secunia.com/advisories/26335
    http://secunia.com/advisories/26393
    http://secunia.com/advisories/26572
    http://secunia.com/advisories/27326
    http://secunia.com/advisories/27414
    http://secunia.com/advisories/28135
    http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.010101
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
    http://www.debian.org/security/2007/dsa-1344
    http://www.debian.org/security/2007/dsa-1345
    http://www.debian.org/security/2007/dsa-1346
    http://www.debian.org/security/2007/dsa-1391
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:152
    http://www.mandriva.com/security/advisories?name=MDVSA-2007:047
    http://www.mandriva.com/security/advisories?name=MDVSA-2008:047
    http://www.mozilla.org/security/announce/2007/mfsa2007-27.html
    http://www.securityfocus.com/archive/1/475265/100/200/threaded
    http://www.securityfocus.com/archive/1/475450/30/5550/threaded
    http://www.securityfocus.com/bid/25053
    http://www.ubuntu.com/usn/usn-493-1
    http://www.ubuntu.com/usn/usn-503-1
    http://www.vupen.com/english/advisories/2007/4256
    http://www.vupen.com/english/advisories/2008/0082
    https://bugzilla.mozilla.org/show_bug.cgi?id=389106
    https://issues.rpath.com/browse/RPL-1600

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High