CVE-2007-2871

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-06-01 · updated 2026-06-16

Description

Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2, allows remote attackers to spoof or hide the browser chrome, such as the location bar, by placing XUL popups outside of the browser's content pane. NOTE: this issue can be leveraged for phishing and other attacks.

Affected products

Mozilla Firefox: 1.5, 1.5.0.1, 1.5.0.2, 1.5.0.3, 1.5.0.4, 1.5.0.5 (+10)
Mozilla Seamonkey: 1.0.9, 1.1.2

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://osvdb.org/35137
http://secunia.com/advisories/25469
http://secunia.com/advisories/25476
http://secunia.com/advisories/25488
http://secunia.com/advisories/25490
http://secunia.com/advisories/25491
http://secunia.com/advisories/25533
http://secunia.com/advisories/25534
http://secunia.com/advisories/25559
http://secunia.com/advisories/25635
http://secunia.com/advisories/25647

Get alerted when CVE-2007-2871 or the next vulnerability affects your stack