CVE-2007-4038
Last modified
CVE-2007-4038 is a vulnerability of currently unknown severity. Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670.. EPSS estimates a 1.11% chance of exploitation in the next 30 days.
Description
Argument injection vulnerability in Mozilla Firefox before 2.0.0.5, when running on systems with Thunderbird 1.5 installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a mailto URI, which are inserted into the command line that is created when invoking Thunderbird.exe, a similar issue to CVE-2007-3670.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 2.0.0.4 |
| Mozilla | Thunderbird | 1.5 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2007-4038?
How severe is CVE-2007-4038?
How do I fix CVE-2007-4038?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2007
- CVE-2007-4032Buffer overflow in CrystalPlayer Pro 1.98 allows user-assist…
- CVE-2007-4033Buffer overflow in the intT1_EnvGetCompletePath function in …
- CVE-2007-4034Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka …
- CVE-2007-4035Guidance Software EnCase does not properly handle (1) certai…
- CVE-2007-4036Guidance Software EnCase allows user-assisted remote attacke…
- CVE-2007-4037Guidance Software EnCase allows user-assisted attackers to t…
- CVE-2007-4039Argument injection vulnerability involving Mozilla, when cer…9.8
- CVE-2007-4040Argument injection vulnerability involving Microsoft Outlook…8.8
- CVE-2007-4041Multiple argument injection vulnerabilities in Mozilla Firef…
- CVE-2007-4042Multiple argument injection vulnerabilities in Netscape Navi…
- CVE-2007-4043file.cgi in Secure Computing SecurityReporter (aka Network S…9.8
- CVE-2007-4044Rejected reason: The MS-RPC functionality in smbd in Samba 3…
Are you affected by CVE-2007-4038?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST