{"id":"CVE-2007-4841","published":"2007-09-12T20:00:00Z","modified":"2024-08-07T15:08:33Z","title":"Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to…","vendor":null,"product":null,"tier":"tail","description":{"text":"Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid \"%\" encoding, related to improper file type handling on Windows XP with Internet Explorer 7 installed, a variant of CVE-2007-3845.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02648,"percentile":0.85562,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/27414","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.mozilla.org/security/announce/2007/mfsa2007-36.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/27360","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/27315","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/bid/25543","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.vupen.com/english/advisories/2007/3544","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.471007","tags":["vendor-advisory","x_refsource_SLACKWARE"]},{"url":"http://www.vupen.com/english/advisories/2008/0083","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://xs-sniper.com/blog/2007/09/01/firefox-file-handling-woes/","tags":["x_refsource_MISC"]},{"url":"http://secunia.com/advisories/27744","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2008/0082","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/28398","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/27311","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://secunia.com/advisories/28363","tags":["third-party-advisory","x_refsource_SECUNIA"]}],"priority":{"score":17.1,"factors":[{"name":"EPSS percentile","points":17.11}]},"euvd":{"id":"EUVD-2007-4822","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2007-4041-family-cve-2007-4041","parents":[{"from":"CVE-2007-3845","to":"CVE-2007-4841","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"…attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid \"%\" encoding, related to improper file type handling on Windows XP with Internet Explorer 7 installed, a variant of CVE-2007-3845.","from":"CVE.org","in":"CVE-2007-4841"}]}]}}