CVE catalog
CVE-2007-5947
xulrunner - several vulnerabilities
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.71% · Oct 25, 2026
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 retrieves the inner URL regardless of its MIME type, and considers HTML documents within a jar archive to have the same origin as the inner URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI. jar: protocol XSS
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | iceweasel | 4.0 | 2.0.0.3-1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.3-2 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.4-0etch1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.4-1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.5-0etch1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.5-0etch1+lenny1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.5-1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.5-2 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.6+2.0.0.8-0etch1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.6-0etch1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.6-0etch1+lenny1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.6-1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.7-1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.7-2 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.8-1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.9-1 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.9-2 | vulnerable |
| Debian | iceweasel | 4.0 | 2.0.0.10-0etch1 | fixed |
| Debian | xulrunner | 4.0 | 1.8.0.11-2 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.11-3 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.11-4 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.11-4.1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.12-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch2 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch3 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.13~pre070720-0etch3+lenny1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.14~pre071019b-0etch1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.14~pre071019b-0lenny1 | vulnerable |
| Debian | xulrunner | 4.0 | 1.8.0.14~pre071019c-0etch1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | iceweasel | deb | 4.0 | 2.0.0.10-0etch1 | Not reported | DSA-1424-1 | Not reported |
| Debian | xulrunner | deb | 4.0 | 1.8.0.14~pre071019c-0etch1 | Not reported | DSA-1425-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: