Vulnerability Name:

CVE-2007-0778 (CCN-32671)

Assigned:2007-02-23
Published:2007-02-23
Updated:2019-10-09
Summary:The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.4 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:N/A:N)
4.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
1.9 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
Vulnerability Consequences:Obtain Information
References:Source: SGI
Type: Broken Link
20070202-01-P

Source: SGI
Type: Broken Link
20070301-01-P

Source: MITRE
Type: CNA
CVE-2007-0778

Source: FEDORA
Type: Broken Link
FEDORA-2007-281

Source: FEDORA
Type: Broken Link
FEDORA-2007-293

Source: HP
Type: Broken Link
HPSBUX02153

Source: SUSE
Type: Broken Link
SUSE-SA:2007:019

Source: CCN
Type: RHSA-2007-0077
Critical: seamonkey security update

Source: REDHAT
Type: Third Party Advisory
RHSA-2007:0077

Source: CCN
Type: RHSA-2007-0078
Critical: thunderbird security update

Source: CCN
Type: RHSA-2007-0079
Critical: Firefox security update

Source: CCN
Type: RHSA-2007-0097
Critical: firefox security update

Source: CCN
Type: RHSA-2007-0108
Critical: thunderbird security update

Source: CCN
Type: SA24205
Mozilla Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
24205

Source: CCN
Type: SA24238
Mozilla SeaMonkey Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
24238

Source: SECUNIA
Type: Third Party Advisory
24287

Source: SECUNIA
Type: Third Party Advisory
24290

Source: SECUNIA
Type: Third Party Advisory
24293

Source: SECUNIA
Type: Third Party Advisory
24320

Source: SECUNIA
Type: Third Party Advisory
24328

Source: SECUNIA
Type: Third Party Advisory
24333

Source: SECUNIA
Type: Third Party Advisory
24342

Source: SECUNIA
Type: Third Party Advisory
24343

Source: SECUNIA
Type: Third Party Advisory
24384

Source: SECUNIA
Type: Third Party Advisory
24393

Source: SECUNIA
Type: Third Party Advisory
24395

Source: SECUNIA
Type: Third Party Advisory
24437

Source: SECUNIA
Type: Third Party Advisory
24455

Source: SECUNIA
Type: Third Party Advisory
24457

Source: SECUNIA
Type: Third Party Advisory
24650

Source: SECUNIA
Type: Third Party Advisory
25588

Source: GENTOO
Type: Third Party Advisory
GLSA-200703-04

Source: CCN
Type: SECTRACK ID: 1017699
Mozilla Firefox Cache Collision May Let Remote Users Obtain Cached Web Page Contents

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1017699

Source: SLACKWARE
Type: Mailing List, Third Party Advisory
SSA:2007-066-05

Source: SLACKWARE
Type: Mailing List, Third Party Advisory
SSA:2007-066-03

Source: CCN
Type: ASA-2007-092
SeaMonkey security update (RHSA-2007-0077)

Source: CCN
Type: ASA-2007-095
thunderbird security update (RHSA-2007-0078)

Source: CCN
Type: ASA-2007-114
Firefox security update (RHSA-2007-0079)

Source: DEBIAN
Type: Third Party Advisory
DSA-1336

Source: DEBIAN
Type: DSA-1336
mozilla-firefox -- several vulnerabilities

Source: CCN
Type: GLSA-200703-04
Mozilla Firefox: Multiple vulnerabilities

Source: CCN
Type: GLSA-200703-08
SeaMonkey: Multiple vulnerabilities

Source: GENTOO
Type: Third Party Advisory
GLSA-200703-08

Source: MANDRIVA
Type: Third Party Advisory
MDKSA-2007:050

Source: CCN
Type: MFSA 2007-03
Information disclosure through cache collisions

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.mozilla.org/security/announce/2007/mfsa2007-03.html

Source: SUSE
Type: Broken Link
SUSE-SA:2007:022

Source: OSVDB
Type: Broken Link
32110

Source: CCN
Type: OSVDB ID: 32110
Mozilla Multiple Products Cache Collision Information Disclosure

Source: REDHAT
Type: Third Party Advisory
RHSA-2007:0078

Source: REDHAT
Type: Third Party Advisory
RHSA-2007:0079

Source: REDHAT
Type: Third Party Advisory
RHSA-2007:0097

Source: REDHAT
Type: Third Party Advisory
RHSA-2007:0108

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20070226 rPSA-2007-0040-1 firefox

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20070303 rPSA-2007-0040-3 firefox thunderbird

Source: BID
Type: Third Party Advisory, VDB Entry
22694

Source: CCN
Type: BID-22694
Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabilities

Source: CCN
Type: USN-428-1
Firefox vulnerabilities

Source: UBUNTU
Type: Third Party Advisory
USN-428-1

Source: CCN
Type: USN-428-2
Firefox regression

Source: VUPEN
Type: Third Party Advisory
ADV-2007-0718

Source: VUPEN
Type: Third Party Advisory
ADV-2008-0083

Source: MISC
Type: Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=347852

Source: XF
Type: Third Party Advisory, VDB Entry
mozilla-diskcache-information-disclosure(32671)

Source: XF
Type: UNKNOWN
mozilla-diskcache-information-disclosure(32671)

Source: CONFIRM
Type: Broken Link
https://issues.rpath.com/browse/RPL-1081

Source: CONFIRM
Type: Broken Link
https://issues.rpath.com/browse/RPL-1103

Source: OVAL
Type: Broken Link
oval:org.mitre.oval:def:9151

Source: SUSE
Type: SUSE-SA:2007:019
MozillaFirefox security update 1.5.0.10/2.0.0.2

Source: SUSE
Type: SUSE-SA:2007:022
Mozilla security problems

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version >= 1.5 and < 1.5.0.10)
  • OR cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version >= 2.0 and < 2.0.0.2)
  • OR cpe:/a:mozilla:seamonkey:*:*:*:*:*:*:*:* (Version < 1.0.8)

    • Configuration 2:
  • cpe:/o:canonical:ubuntu_linux:5.10:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0::alpha:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0::beta:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_school_server:-:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20070778
    V
    		CVE-2007-0778
    2015-11-16
    oval:org.mitre.oval:def:21788
    P
    		ELSA-2007:0097: firefox security update (Critical)
    2014-05-26
    oval:org.mitre.oval:def:22262
    P
    		ELSA-2007:0108: thunderbird security update (Critical)
    2014-05-26
    oval:org.mitre.oval:def:9151
    V
    		The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors when the target page is reloaded from the cache.
    2013-04-29
    oval:com.redhat.rhsa:def:20070077
    P
    		RHSA-2007:0077: seamonkey security update (Critical)
    2008-03-20
    oval:com.redhat.rhsa:def:20070097
    P
    		RHSA-2007:0097: firefox security update (Critical)
    2008-03-20
    oval:org.debian:def:1336
    V
    		several vulnerabilities
    2007-07-22
    oval:com.redhat.rhsa:def:20070078
    P
    		RHSA-2007:0078: thunderbird security update (Critical)
    2007-04-10
    oval:com.redhat.rhsa:def:20070108
    P
    		RHSA-2007:0108: thunderbird security update (Critical)
    2007-03-14
    oval:com.redhat.rhsa:def:20070079
    P
    		RHSA-2007:0079: Firefox security update (Critical)
    2007-02-23
    BACK
    mozilla firefox *
    mozilla firefox *
    mozilla seamonkey *
    canonical ubuntu linux 5.10
    canonical ubuntu linux 6.06
    canonical ubuntu linux 6.10
    debian debian linux 3.1
    mozilla firefox 1.5 beta1
    mozilla firefox 2.0
    mozilla firefox 1.5.0.2
    mozilla firefox 1.5.0.3
    mozilla firefox 1.5.0.4
    mozilla firefox 1.5.0.6
    mozilla firefox 1.5.0.7
    mozilla seamonkey 1.0.5
    mozilla seamonkey 1.0.7
    mozilla seamonkey 1.0.2
    mozilla firefox 1.5.0.9
    mozilla firefox 2.0.0.1
    mozilla firefox 2.0 beta1
    mozilla firefox 2.0 rc2
    mozilla firefox 2.0 rc3
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0.1
    mozilla seamonkey 1.0.3
    mozilla seamonkey 1.0.4
    mozilla seamonkey 1.0.6
    mozilla firefox 1.0.5
    mozilla firefox 1.5.0.1
    mozilla firefox 1.5.0.5
    mozilla firefox 1.5.0.8
    mozilla firefox 1.5 beta2
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0
    gentoo linux *
    suse linux enterprise server 8
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    suse suse linux school server -
    redhat enterprise linux 3
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    debian debian linux 3.1
    novell open enterprise server *
    suse suse linux 10.0
    redhat linux advanced workstation 2.1
    canonical ubuntu 6.06
    suse suse linux 10.1
    mandrakesoft mandrake linux 2007
    mandrakesoft mandrake linux 2007
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux desktop 5.0
    redhat enterprise linux 5
    redhat enterprise linux 5
    redhat enterprise linux 5
    novell open enterprise server *
    novell opensuse 10.2
    suse suse linux 9.3