CVE-2007-1092

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-02-26 · updated 2026-06-16

Description

Mozilla Firefox 1.5.0.9 and 2.0.0.1, and SeaMonkey before 1.0.8 allow remote attackers to execute arbitrary code via JavaScript onUnload handlers that modify the structure of a document, wich triggers memory corruption due to the lack of a finalize hook on DOM window objects.

Affected products

Mozilla Firefox: 1.5.0.9, 2.0.0.1
Mozilla Seamonkey: through 1.0.7

References

http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0525.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
http://osvdb.org/32103
http://secunia.com/advisories/24333
http://secunia.com/advisories/24343
http://secunia.com/advisories/24384
http://secunia.com/advisories/24395
http://secunia.com/advisories/24457
http://secunia.com/advisories/24650

Get alerted when CVE-2007-1092 or the next vulnerability affects your stack