Back to CVE Browser

CVE-2007-4841

CRITICAL

9.3

CVSS Severity Score

EPSS Score0.1870%

EPSS Percentile12.26th

PublishedSep 12, 2007

Last ModifiedApr 23, 2026

Vulnerability Description

Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands via a (1) mailto, (2) nntp, (3) news, or (4) snews URI with invalid "%" encoding, related to improper file type handling on Windows XP with Internet Explorer 7 installed, a variant of CVE-2007-3845.

Affected Platforms (CPE)

📦

Mozilla

Firefox

<= 2.0.0.8

📦

Mozilla

Seamonkey

<= 1.1.5

📦

Mozilla

Thunderbird

<= 2.0.0.8

References & Advisories

🔗 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

🔗 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579

🔗 http://secunia.com/advisories/27311

🔗 http://secunia.com/advisories/27315

🔗 http://secunia.com/advisories/27360

🔗 http://secunia.com/advisories/27414

🔗 http://secunia.com/advisories/27744

🔗 http://secunia.com/advisories/28363

Related Vulnerabilities

CVE-2026-121917.8

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdri...

CVE-2026-121905.3

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the compo...

CVE-2026-121895.3

A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzm...

CVE-2026-121886.3

A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules...