CVE ID:	CVE-2007-5960
Description:	Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 sets the Referer header to the window or frame in which script is running, instead of the address of the content that initiated the script, which allows remote attackers to spoof HTTP Referer headers and bypass Referer-based CSRF protection schemes by setting window.location and using a modal alert dialog that causes the wrong Referer to be sent.
Test IDs:	1.3.6.1.4.1.25623.1.0.59959   1.3.6.1.4.1.25623.1.1.1.1.2007.1424
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2007-5960 1018977 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1018977.1-1 1018995 http://securitytracker.com/id?1018995 20080212 FLEA-2008-0001-1 firefox http://www.securityfocus.com/archive/1/488002/100/0/threaded 20080229 rPSA-2008-0093-1 thunderbird http://www.securityfocus.com/archive/1/488971/100/0/threaded 231441 http://sunsolve.sun.com/search/document.do?assetkey=1-26-231441-1 26589 http://www.securityfocus.com/bid/26589 27725 http://secunia.com/advisories/27725 27793 http://secunia.com/advisories/27793 27796 http://secunia.com/advisories/27796 27797 http://secunia.com/advisories/27797 27800 http://secunia.com/advisories/27800 27816 http://secunia.com/advisories/27816 27838 http://secunia.com/advisories/27838 27845 http://secunia.com/advisories/27845 27855 http://secunia.com/advisories/27855 27944 http://secunia.com/advisories/27944 27955 http://secunia.com/advisories/27955 27957 http://secunia.com/advisories/27957 27979 http://secunia.com/advisories/27979 28001 http://secunia.com/advisories/28001 28016 http://secunia.com/advisories/28016 28171 http://secunia.com/advisories/28171 28277 http://secunia.com/advisories/28277 28398 http://secunia.com/advisories/28398 29164 http://secunia.com/advisories/29164 ADV-2007-4002 http://www.vupen.com/english/advisories/2007/4002 ADV-2007-4018 http://www.vupen.com/english/advisories/2007/4018 ADV-2008-0083 http://www.vupen.com/english/advisories/2008/0083 ADV-2008-0643 http://www.vupen.com/english/advisories/2008/0643 DSA-1424 http://www.debian.org/security/2007/dsa-1424 DSA-1425 http://www.debian.org/security/2007/dsa-1425 FEDORA-2007-3952 https://www.redhat.com/archives/fedora-package-announce/2007-November/msg01011.html FEDORA-2007-4098 https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00168.html FEDORA-2007-4106 https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00135.html FEDORA-2007-756 https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00115.html GLSA-200712-21 http://security.gentoo.org/glsa/glsa-200712-21.xml HPSBUX02153 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 MDKSA-2007:246 http://www.mandriva.com/security/advisories?name=MDKSA-2007:246 RHSA-2007:1082 http://www.redhat.com/support/errata/RHSA-2007-1082.html RHSA-2007:1083 http://www.redhat.com/support/errata/RHSA-2007-1083.html RHSA-2007:1084 http://www.redhat.com/support/errata/RHSA-2007-1084.html SSA:2007-331-01 http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374833 SSA:2007-333-01 http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.365006 SSRT061181 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 SUSE-SA:2007:066 http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00004.html USN-546-1 https://usn.ubuntu.com/546-1/ USN-546-2 http://www.ubuntu.com/usn/usn-546-2 http://browser.netscape.com/releasenotes/ http://browser.netscape.com/releasenotes/ http://bugs.gentoo.org/show_bug.cgi?id=198965 http://bugs.gentoo.org/show_bug.cgi?id=198965 http://bugs.gentoo.org/show_bug.cgi?id=200909 http://bugs.gentoo.org/show_bug.cgi?id=200909 http://wiki.rpath.com/Advisories:rPSA-2008-0093 http://wiki.rpath.com/Advisories:rPSA-2008-0093 http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260 http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0260 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0093 http://www.mozilla.org/security/announce/2007/mfsa2007-39.html http://www.mozilla.org/security/announce/2007/mfsa2007-39.html https://issues.rpath.com/browse/RPL-1984 https://issues.rpath.com/browse/RPL-1984 https://issues.rpath.com/browse/RPL-1995 https://issues.rpath.com/browse/RPL-1995 mozilla-http-referer-spoofing(38644) https://exchange.xforce.ibmcloud.com/vulnerabilities/38644 oval:org.mitre.oval:def:9794 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9794