VulnerabilityModified

CVE-2003-0791

The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed.

CRITICAL 9.8EPSS 2.13%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.13% probability · 81th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: mozilla/mozilla · sco/openserver
Source: cve@mitre.org

References

http://secunia.com/advisories/11103/URL Repurposed
http://www.mandriva.com/security/advisories?name=MDKSA-2004:021Broken Link
http://www.osvdb.org/8390Broken Link, Patch, Vendor Advisory
http://www.securityfocus.com/advisories/6979Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/9322Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=221526Issue Tracking, Patch, Vendor Advisory
http://secunia.com/advisories/11103/URL Repurposed
http://www.mandriva.com/security/advisories?name=MDKSA-2004:021Broken Link
http://www.osvdb.org/8390Broken Link, Patch, Vendor Advisory
http://www.securityfocus.com/advisories/6979Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://www.securityfocus.com/bid/9322Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=221526Issue Tracking, Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.