What’s Vulnerable › Vulnerabilities

CVE-2007-0994

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2007-03-06 · updated 2026-06-16
• Weakness: CWE-94

Description

A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrome privileges.

Affected products

• Debian Linux: 3.1
• Mozilla Firefox: from 1.5 before 1.5.0.10; from 2.0 before 2.0.0.2 — fixed in 1.5.0.10, 2.0.0.2
• Mozilla Seamonkey: from 1.0 before 1.0.8; from 1.1 before 1.1.1 — fixed in 1.0.8, 1.1.1

How to fix

Upgrade to a fixed version: Mozilla Firefox 1.5.0.10, 2.0.0.2; Mozilla Seamonkey 1.0.8, 1.1.1. Check the vendor advisory for mitigations.

References

• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230733
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
• http://secunia.com/advisories/24384
• http://secunia.com/advisories/24395
• http://secunia.com/advisories/24455
• http://secunia.com/advisories/24457
• http://secunia.com/advisories/24650
• http://secunia.com/advisories/25588
• http://securitytracker.com/id?1017726

Get alerted when CVE-2007-0994 or the next vulnerability affects your stack