| Name | CVE-2007-1084 |
| Description | Mozilla Firefox 2.0.0.1 and earlier does not prompt users before saving bookmarklets, which allows remote attackers to bypass the same-domain policy by tricking a user into saving a bookmarklet with a data: scheme, which is executed in the context of the last visited web page. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 556268, 556270, 556271, 556272 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| conkeror (PTS) | jessie | 1.0~~pre-1+git141025-1+deb8u2 | fixed |
| stretch | 1.0.3+git170123-1 | fixed | |
| epiphany-browser (PTS) | jessie | 3.14.1-1 | vulnerable |
| stretch | 3.22.7-1 | vulnerable | |
| buster (security), buster, buster (lts) | 3.32.1.2-3~deb10u3 | vulnerable | |
| bullseye (security), bullseye | 3.38.2-1+deb11u3 | vulnerable | |
| bookworm | 43.1-1 | vulnerable | |
| trixie | 47.0-1 | vulnerable | |
| sid | 47.2-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| conkeror | source | (unstable) | (not affected) | |||
| epiphany-browser | source | (unstable) | (unfixed) | unimportant | 556272 | |
| galeon | source | (unstable) | 2.0.7-2 | unimportant | 556270 | |
| iceape | source | (unstable) | (unfixed) | unimportant | ||
| iceweasel | source | (unstable) | (unfixed) | unimportant | 556268 | |
| kazehakase | source | lenny | 0.5.4-2lenny1 | |||
| kazehakase | source | (unstable) | 0.5.8-2 | 556271 | ||
| webkit | source | (unstable) | (not affected) |
only epiphany-gecko backend affected
- conkeror <not-affected> (doesn't support bookmarks)
- webkit <not-affected> (doesn't support javascript embedded in bookmarks)