Cloudanix VulnDB

CVE-2005-1477

None

CVSS

—

EPSS

15.2%

Published

May 9, 2005

CISA due date

—

The record

The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

Affected packages

Ecosystem Package Introduced Fixed
Red Hat:enterprise_linux:4::as devhelp 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::as devhelp-debuginfo 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::as devhelp-devel 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::as firefox 0 0:1.0.4-1.4.1
Red Hat:enterprise_linux:4::as firefox-debuginfo 0 0:1.0.4-1.4.1
Red Hat:enterprise_linux:4::desktop devhelp 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::desktop devhelp-debuginfo 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::desktop devhelp-devel 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::desktop firefox 0 0:1.0.4-1.4.1
Red Hat:enterprise_linux:4::desktop firefox-debuginfo 0 0:1.0.4-1.4.1
Red Hat:enterprise_linux:4::es devhelp 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::es devhelp-debuginfo 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::es devhelp-devel 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::es firefox 0 0:1.0.4-1.4.1
Red Hat:enterprise_linux:4::es firefox-debuginfo 0 0:1.0.4-1.4.1
Red Hat:enterprise_linux:4::ws devhelp 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::ws devhelp-debuginfo 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::ws devhelp-devel 0 0:0.9.2-2.4.5
Red Hat:enterprise_linux:4::ws firefox 0 0:1.0.4-1.4.1
Red Hat:enterprise_linux:4::ws firefox-debuginfo 0 0:1.0.4-1.4.1

Related vulnerabilities