{"id":"CVE-2007-4041","published":"2007-07-27T22:00:00Z","modified":"2024-08-07T14:37:06Z","title":"Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute…","vendor":null,"product":null,"tier":"tail","description":{"text":"Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.19655,"percentile":0.97383,"provenance":"source"},"cwes":[],"references":[{"url":"http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005/","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/25053","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://xs-sniper.com/blog/remote-command-exec-firefox-2005/","tags":["x_refsource_MISC"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=389106","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=389580","tags":["x_refsource_CONFIRM"]},{"url":"http://www.kb.cert.org/vuls/id/783400","tags":["third-party-advisory","x_refsource_CERT-VN"]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.48}]},"euvd":{"id":"EUVD-2007-4025","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2007-4041-family-cve-2007-4041","parents":[{"from":"CVE-2007-3670","to":"CVE-2007-4041","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"…Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.","from":"CVE.org","in":"CVE-2007-4041"}]}],"children":[{"from":"CVE-2007-4041","to":"CVE-2007-3845","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"….0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching \"a file handling program based on the file extension at the end of the URI,\" a variant of CVE-2007-4041.","from":"CVE.org","in":"CVE-2007-3845"}]}]}}