{"id":"CVE-2007-3074","aliases":["DSA-1697-1","DSA-1704-1","DSA-1707-1","EUVD-2007-3066","GHSA-m688-42p9-r3mv"],"status":"published","title":"Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox...","description":"Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox installation directory via a resource:// URI.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01177,"percentile":0.67825,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2007-06-06T10:00:00Z","modified":"2026-06-16T22:41:01Z","affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"iceape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.13~pre080614i-0etch1"}]}],"versions":["1.0.10~pre070720-0etch1","1.0.10~pre070720-0etch1+lenny1","1.0.10~pre070720-0etch3","1.0.10~pre070720-0etch3+lenny1","1.0.11~pre071022-0etch1","1.0.11~pre071022-0etch1+lenny1","1.0.12~pre080131b-0etch1","1.0.12~pre080131b-0etch2","1.0.13~pre080323b-0etch1","1.0.13~pre080323b-0etch2","1.0.13~pre080323b-0etch3","1.0.8-4","1.0.9-0etch1"],"bundled":47},{"source":"osv","ecosystem":"Debian:4.0","package":"xulrunner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.15~pre080614i-0etch1"}]}],"versions":["1.8.0.11-2","1.8.0.11-3","1.8.0.11-4","1.8.0.11-4.1","1.8.0.12-0etch1","1.8.0.13~pre070720-0etch1","1.8.0.13~pre070720-0etch2","1.8.0.13~pre070720-0etch3","1.8.0.13~pre070720-0etch3+lenny1","1.8.0.14~pre071019b-0etch1","1.8.0.14~pre071019b-0lenny1","1.8.0.14~pre071019c-0etch1","1.8.0.15~pre080131a-0etch1","1.8.0.15~pre080131b-0etch1","1.8.0.15~pre080323b-0etch1","1.8.0.15~pre080323b-0etch2","1.8.0.15~pre080614d-0etch1","1.8.0.15~pre080614h-0etch1"],"bundled":8},{"source":"osv","ecosystem":"Debian:4.0","package":"iceweasel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.19-0etch1"}]}],"versions":["2.0.0.10-0etch1","2.0.0.10-1","2.0.0.10-2","2.0.0.11-1","2.0.0.12-0etch1","2.0.0.12-1","2.0.0.12-2","2.0.0.13-0etch1","2.0.0.13-1","2.0.0.14-0etch1","2.0.0.14-1","2.0.0.14-2","2.0.0.15-0etch1","2.0.0.16-0etch1","2.0.0.17-0etch1","2.0.0.18-0etch1","2.0.0.3-1","2.0.0.3-2","2.0.0.4-0etch1","2.0.0.4-1","2.0.0.5-0etch1","2.0.0.5-0etch1+lenny1","2.0.0.5-1","2.0.0.5-2","2.0.0.6+2.0.0.8-0etch1","2.0.0.6-0etch1","2.0.0.6-0etch1+lenny1","2.0.0.6-1","2.0.0.7-1","2.0.0.7-2","2.0.0.8-1","2.0.0.9-1","2.0.0.9-2"],"bundled":11}],"products":[{"vendor":"mozilla","product":"firefox"}],"references":[{"url":"http://www.securityfocus.com/archive/1/470500/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://osvdb.org/35918","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://larholm.com/2007/05/25/firefox-0day-local-file-reading/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=367428","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://secunia.com/advisories/25481","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3074"},{"url":"http://ha.ckers.org/blog/20070516/read-firefox-settings-poc"},{"url":"http://larholm.com/2007/05/25/firefox-0day-local-file-reading"},{"url":"http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004"},{"url":"https://github.com/advisories/GHSA-m688-42p9-r3mv"}],"sources":{"cve":[{"id":"CVE-2007-3074","description":"Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox installation directory via a resource:// URI.","status":"published","published":"2007-06-06T10:00:00Z","modified":"2024-08-07T14:05:29.245Z","updated_at":"2026-11-02T13:32:56.730199Z"}],"euvd":[{"id":"EUVD-2007-3066","description":"Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox installation directory via a resource:// URI.","status":"published","published":"2007-06-06T10:00:00Z","modified":"2024-08-07T14:05:29Z","updated_at":"2026-11-03T01:38:18.026387Z"}],"ghsa":[{"id":"GHSA-m688-42p9-r3mv","title":"Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox...","description":"Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox installation directory via a resource:// URI.","status":"published","published":"2022-05-01T18:10:12Z","modified":"2025-04-09T03:43:26Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:00:53.859901Z"}],"nvd":[{"id":"CVE-2007-3074","description":"Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox installation directory via a resource:// URI.","status":"published","published":"2007-06-06T10:30:00Z","modified":"2026-06-16T22:41:01.067Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:01:16.479378Z"}],"osv":[{"id":"DSA-1697-1","title":"iceape - several vulnerabilities","status":"published","published":"2009-01-07T00:00:00Z","modified":"2026-03-09T01:23:08.685469Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DSA-1704-1","title":"xulrunner - several vulnerabilities","status":"published","published":"2009-01-14T00:00:00Z","modified":"2026-03-09T01:23:32.762857Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DSA-1707-1","title":"iceweasel - several vulnerabilities","status":"published","published":"2009-01-15T00:00:00Z","modified":"2026-03-09T01:19:03.736341Z","updated_at":"2026-11-02T15:46:14.734124Z"}]}}