CVE-2007-2292

Publication date 26 April 2007

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.

Status

Package Ubuntu Release Status
firefox 7.10 gutsy
Fixed 2.0.0.8+2nobinonly-0ubuntu1
7.04 feisty
Fixed 2.0.0.8+1nobinonly-0ubuntu1
6.10 edgy
Fixed 2.0.0.8+0dfsg-0ubuntu0.6.10
6.06 LTS dapper
Fixed 1.5.dfsg+1.5.0.14~prepatch071011b-0ubuntu1
mozilla-thunderbird 7.04 feisty
Fixed 1.5.0.13+1.5.0.14b-0ubuntu0.7.04
6.10 edgy
Fixed 1.5.0.13+1.5.0.14b-0ubuntu0.6.10
6.06 LTS dapper
Fixed 1.5.0.13+1.5.0.14b-0ubuntu0.6.06
thunderbird 7.10 gutsy
Fixed 2.0.0.8~pre071022+nobinonly-0ubuntu0.7.10

References

Related Ubuntu Security Notices (USN)

    • USN-536-1
    • Thunderbird vulnerabilities
    • 23 October 2007
    • USN-535-1
    • Firefox vulnerabilities
    • 22 October 2007

Other references