CVE-2007-1256

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=full-disclosure&m=117258301222007&w=2Third Party Advisory
http://marc.info/?l=full-disclosure&m=117259225402112&w=2Third Party Advisory
http://osvdb.org/35913Broken Link
http://www.securityfocus.com/archive/1/461437/100/0/threaded
http://marc.info/?l=full-disclosure&m=117258301222007&w=2Third Party Advisory
http://marc.info/?l=full-disclosure&m=117259225402112&w=2Third Party Advisory
http://osvdb.org/35913Broken Link
http://www.securityfocus.com/archive/1/461437/100/0/threaded

Timeline

Published: Mar 3, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-125710.0The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via ce CVE-2007-12586.1Unspecified vulnerability in Cisco IOS 12.2SXA, SXB, SXD, and SXF; and the MSFC2, MSFC2a and MSFC3 running in Hybrid Mode on Cisco Catalyst CVE-2007-12597.5Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors.CVE-2007-12607.5Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via CVE-2007-12617.5Unspecified vulnerability in the reports system in OpenBiblio before 0.6.0 allows attackers to gain privileges via unspecified vectors.CVE-2007-12624.3Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject CVE-2007-12635.0GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions o CVE-2007-12645.0Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distin CVE-2007-12657.8KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishin CVE-2007-12665.0Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually disti CVE-2007-12675.0Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Sylpheed from visually disting CVE-2007-12685.0Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing