VULNERABILITY INTELLIGENCE

CVE-2007-4841

CVSS score9.3 HIGH
EPSS probability2.65%
CISA KEVNot currently listed
Published2007-09-12
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid "%" encoding, related to improper file type handling on Windows XP with Internet Explorer 7 installed, a variant of CVE-2007-3845.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references