Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2004-0905

Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.

Published

2004-09-14T04:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.6 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

3.9

Impact Score

6.4

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	0.8	Yes
Application	mozilla	firefox	0.9	Yes
Application	mozilla	firefox	0.9	Yes
Application	mozilla	firefox	0.9.1	Yes
Application	mozilla	firefox	0.9.2	Yes
Application	mozilla	firefox	0.9.3	Yes
Application	mozilla	mozilla	1.0	Yes
Application	mozilla	mozilla	1.0	Yes
Application	mozilla	mozilla	1.0	Yes
Application	mozilla	mozilla	1.0.1	Yes
Application	mozilla	mozilla	1.0.2	Yes
Application	mozilla	mozilla	1.1	Yes
Application	mozilla	mozilla	1.1	Yes
Application	mozilla	mozilla	1.1	Yes
Application	mozilla	mozilla	1.2	Yes
Application	mozilla	mozilla	1.2	Yes
Application	mozilla	mozilla	1.2	Yes
Application	mozilla	mozilla	1.2.1	Yes
Application	mozilla	mozilla	1.3	Yes
Application	mozilla	mozilla	1.3.1	Yes
Application	mozilla	mozilla	1.4	Yes
Application	mozilla	mozilla	1.4	Yes
Application	mozilla	mozilla	1.4	Yes
Application	mozilla	mozilla	1.4.1	Yes
Application	mozilla	mozilla	1.4.2	Yes
Application	mozilla	mozilla	1.5	Yes
Application	mozilla	mozilla	1.6	Yes
Application	mozilla	mozilla	1.7	Yes
Application	mozilla	mozilla	1.7	Yes
Application	mozilla	mozilla	1.7.1	Yes
Application	mozilla	mozilla	1.7.2	Yes
Application	netscape	navigator	7.0	Yes
Application	netscape	navigator	7.0.2	Yes
Application	netscape	navigator	7.1	Yes
Application	netscape	navigator	7.2	Yes
Operating System	conectiva	linux	9.0	Yes
Operating System	conectiva	linux	10.0	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	2.1	Yes
Operating System	redhat	enterprise_linux	3.0	Yes
Operating System	redhat	enterprise_linux	3.0	Yes
Operating System	redhat	enterprise_linux	3.0	Yes
Operating System	redhat	enterprise_linux_desktop	3.0	Yes
Operating System	redhat	fedora_core	core_1.0	Yes
Operating System	redhat	linux	7.3	Yes
Operating System	redhat	linux	7.3	Yes
Operating System	redhat	linux	7.3	Yes
Operating System	redhat	linux	9.0	Yes
Operating System	redhat	linux_advanced_workstation	2.1	Yes
Operating System	redhat	linux_advanced_workstation	2.1	Yes
Operating System	suse	suse_linux	1.0	Yes
Operating System	suse	suse_linux	8	Yes
Operating System	suse	suse_linux	8.1	Yes
Operating System	suse	suse_linux	8.2	Yes
Operating System	suse	suse_linux	9.0	Yes
Operating System	suse	suse_linux	9.0	Yes
Operating System	suse	suse_linux	9.0	Yes
Operating System	suse	suse_linux	9.1	Yes

References

http://bugzilla.mozilla.org/show_bug.cgi?id=250862 Patch, Vendor Advisory ([email protected])
http://marc.info/?l=bugtraq&m=109698896104418&w=2 ([email protected])
http://marc.info/?l=bugtraq&m=109900315219363&w=2 ([email protected])
http://security.gentoo.org/glsa/glsa-200409-26.xml Patch, Vendor Advisory ([email protected])
http://www.kb.cert.org/vuls/id/651928 Patch, Third Party Advisory, US Government Resource ([email protected])
http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3 Vendor Advisory ([email protected])
http://www.novell.com/linux/security/advisories/2004_36_mozilla.html Patch, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/11177 Exploit, Patch, Vendor Advisory ([email protected])
http://www.us-cert.gov/cas/techalerts/TA04-261A.html Patch, Third Party Advisory, US Government Resource ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/17374 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10378 ([email protected])
http://bugzilla.mozilla.org/show_bug.cgi?id=250862 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=109698896104418&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://marc.info/?l=bugtraq&m=109900315219363&w=2 (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200409-26.xml Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/651928 Patch, Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.novell.com/linux/security/advisories/2004_36_mozilla.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/11177 Exploit, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.us-cert.gov/cas/techalerts/TA04-261A.html Patch, Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/17374 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10378 (af854a3a-2127-422b-91ae-364da2661108)