Unrated severityNVD Advisory· Published Nov 26, 2007· Updated Jun 16, 2026
CVE-2007-5960
CVE-2007-5960
Description
Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
54cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*+ 51 more
- cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*
- (no CPE)range: <2.0.0.10
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*range: <=1.1.7
- (no CPE)range: <1.1.7
Patches
Vulnerability mechanics
References
57- secunia.com/advisories/27725nvdVendor Advisory
- secunia.com/advisories/27793nvdVendor Advisory
- secunia.com/advisories/27796nvdVendor Advisory
- secunia.com/advisories/27797nvdVendor Advisory
- secunia.com/advisories/27800nvdVendor Advisory
- secunia.com/advisories/27816nvdVendor Advisory
- secunia.com/advisories/27838nvdVendor Advisory
- secunia.com/advisories/27845nvdVendor Advisory
- secunia.com/advisories/27855nvdVendor Advisory
- secunia.com/advisories/27944nvdVendor Advisory
- secunia.com/advisories/27955nvdVendor Advisory
- secunia.com/advisories/27957nvdVendor Advisory
- secunia.com/advisories/27979nvdVendor Advisory
- secunia.com/advisories/28001nvdVendor Advisory
- secunia.com/advisories/28016nvdVendor Advisory
- secunia.com/advisories/28171nvdVendor Advisory
- secunia.com/advisories/28277nvdVendor Advisory
- secunia.com/advisories/28398nvdVendor Advisory
- www.redhat.com/support/errata/RHSA-2007-1082.htmlnvdVendor Advisory
- www.redhat.com/support/errata/RHSA-2007-1083.htmlnvdVendor Advisory
- www.redhat.com/support/errata/RHSA-2007-1084.htmlnvdVendor Advisory
- browser.netscape.com/releasenotes/nvd
- bugs.gentoo.org/show_bug.cginvd
- bugs.gentoo.org/show_bug.cginvd
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jspnvd
- lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.htmlnvd
- secunia.com/advisories/29164nvd
- security.gentoo.org/glsa/glsa-200712-21.xmlnvd
- securitytracker.com/idnvd
- slackware.com/security/viewer.phpnvd
- slackware.com/security/viewer.phpnvd
- sunsolve.sun.com/search/document.donvd
- sunsolve.sun.com/search/document.donvd
- wiki.rpath.com/Advisories:rPSA-2008-0093nvd
- wiki.rpath.com/wiki/Advisories:rPSA-2007-0260nvd
- wiki.rpath.com/wiki/Advisories:rPSA-2008-0093nvd
- www.debian.org/security/2007/dsa-1424nvd
- www.debian.org/security/2007/dsa-1425nvd
- www.mandriva.com/security/advisoriesnvd
- www.mozilla.org/security/announce/2007/mfsa2007-39.htmlnvd
- www.securityfocus.com/archive/1/488002/100/0/threadednvd
- www.securityfocus.com/archive/1/488971/100/0/threadednvd
- www.securityfocus.com/bid/26589nvd
- www.ubuntu.com/usn/usn-546-2nvd
- www.vupen.com/english/advisories/2007/4002nvd
- www.vupen.com/english/advisories/2007/4018nvd
- www.vupen.com/english/advisories/2008/0083nvd
- www.vupen.com/english/advisories/2008/0643nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/38644nvd
- issues.rpath.com/browse/RPL-1984nvd
- issues.rpath.com/browse/RPL-1995nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794nvd
- usn.ubuntu.com/546-1/nvd
- www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.htmlnvd
News mentions
0No linked articles in our index yet.