CVE catalog

CVE-2007-0996

mozilla-firefox

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.12% · Oct 27, 2026

The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmozilla-firefox3.11.0.4-2vulnerable
Debianmozilla-firefox3.11.0.4-2sarge1vulnerable
Debianmozilla-firefox3.11.0.4-2sarge10vulnerable
Debianmozilla-firefox3.11.0.4-2sarge11vulnerable
Debianmozilla-firefox3.11.0.4-2sarge12vulnerable
Debianmozilla-firefox3.11.0.4-2sarge13vulnerable
Debianmozilla-firefox3.11.0.4-2sarge14vulnerable
Debianmozilla-firefox3.11.0.4-2sarge15vulnerable
Debianmozilla-firefox3.11.0.4-2sarge2vulnerable
Debianmozilla-firefox3.11.0.4-2sarge3vulnerable
Debianmozilla-firefox3.11.0.4-2sarge4vulnerable
Debianmozilla-firefox3.11.0.4-2sarge5vulnerable
Debianmozilla-firefox3.11.0.4-2sarge6vulnerable
Debianmozilla-firefox3.11.0.4-2sarge7vulnerable
Debianmozilla-firefox3.11.0.4-2sarge9vulnerable
Debianmozilla-firefox3.11.0.4-2sarge17fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmozilla-firefoxdeb3.11.0.4-2sarge17Not reportedDSA-1336-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]