CVE-2007-4879

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-13 · updated 2026-06-16

Description

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains.

Affected products

Mozilla Firefox: through 2.0.0.12; 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+58)
Mozilla Seamonkey: through 1.1.8; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+16)

References

http://0x90.eu/ff_tls_poc.html
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
http://secunia.com/advisories/29526
http://secunia.com/advisories/29539
http://secunia.com/advisories/29541
http://secunia.com/advisories/29547
http://secunia.com/advisories/29558
http://secunia.com/advisories/29560
http://secunia.com/advisories/29616
http://secunia.com/advisories/29645
http://secunia.com/advisories/30327
http://secunia.com/advisories/30620

Get alerted when CVE-2007-4879 or the next vulnerability affects your stack