RCE in Mozilla Firefox

CVE-2007-4038

Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.011 (62.6th percentile) — read the EPSS interpretation.

Affected products

Mozilla Firefox
Mozilla Thunderbird — versions 1.5
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (mailing-list, x_refsource_FULLDISC)