CVE-2007-5947

Description

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI.

Category

4.3
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 7.92% Top 10%
Vendor Advisory debian.org Vendor Advisory opensuse.org Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory slackware.com Vendor Advisory redhat.com Vendor Advisory hp.com Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory sun.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory sun.com Vendor Advisory slackware.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory mozilla.org
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://secunia.com/advisories/27816 third party advisory vendor advisory
http://browser.netscape.com/releasenotes/
http://secunia.com/advisories/27855 third party advisory vendor advisory
http://www.debian.org/security/2007/dsa-1424 vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html vendor advisory
http://security.gentoo.org/glsa/glsa-200712-21.xml vendor advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260
https://issues.rpath.com/browse/RPL-1995
http://secunia.com/advisories/28277 third party advisory vendor advisory
http://www.mozilla.org/security/announce/2007/mfsa2007-37.html vendor advisory
http://secunia.com/advisories/27845 third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-1083.html vendor advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093
http://bugs.gentoo.org/show_bug.cgi?id=200909
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9873 vdb entry signature
http://www.vupen.com/english/advisories/2008/0643 vdb entry
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-1082.html vendor advisory
http://secunia.com/advisories/27605 third party advisory vendor advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833 vendor advisory
http://secunia.com/advisories/28016 third party advisory vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html vendor advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:246 vendor advisory
https://usn.ubuntu.com/546-1/ vendor advisory
http://www.vupen.com/english/advisories/2007/4018 vdb entry
http://www.securityfocus.com/archive/1/488971/100/0/threaded mailing list
http://secunia.com/advisories/27838 third party advisory vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html vendor advisory
http://www.securityfocus.com/archive/1/488002/100/0/threaded mailing list
http://www.vupen.com/english/advisories/2007/4002 vdb entry
http://www.securityfocus.com/bid/26385 vdb entry
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1 vendor advisory
http://www.kb.cert.org/vuls/id/715737 third party advisory us government resource
http://secunia.com/advisories/27793 third party advisory vendor advisory
http://bugs.gentoo.org/show_bug.cgi?id=198965
http://www.vupen.com/english/advisories/2008/0083 vdb entry
http://www.gnucitizen.org/blog/web-mayhem-firefoxs-jar-protocol-issues
http://secunia.com/advisories/27955 third party advisory vendor advisory
http://wiki.rpath.com/Advisories:rPSA-2008-0093
http://www.ubuntu.com/usn/usn-546-2 vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1 vendor advisory
http://secunia.com/advisories/27957 third party advisory vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/38356 vdb entry
http://secunia.com/advisories/28398 third party advisory vendor advisory
http://secunia.com/advisories/29164 third party advisory
http://secunia.com/advisories/28001 third party advisory vendor advisory
http://secunia.com/advisories/27796 third party advisory vendor advisory
http://www.securitytracker.com/id?1018928 vdb entry
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006 vendor advisory
https://issues.rpath.com/browse/RPL-1984
http://secunia.com/advisories/27797 third party advisory vendor advisory
http://secunia.com/advisories/27979 third party advisory vendor advisory
http://secunia.com/advisories/28171 third party advisory vendor advisory
http://secunia.com/advisories/27800 third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-1084.html vendor advisory
http://www.debian.org/security/2007/dsa-1425 vendor advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=369814
http://www.vupen.com/english/advisories/2007/3818 vdb entry
http://secunia.com/advisories/27944 third party advisory vendor advisory

Frequently Asked Questions

What is the severity of CVE-2007-5947?
CVE-2007-5947 has been scored as a medium severity vulnerability.
How to fix CVE-2007-5947?
To fix CVE-2007-5947, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-5947 being actively exploited in the wild?
It is possible that CVE-2007-5947 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~8% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.