CVE-2004-0909
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities…
Does this matter?
Lower severity and a low EPSS score (1.71%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 1.71% probability · 76th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/mozilla · mozilla/thunderbird
- Source
- cve@mitre.org
References
- http://bugzilla.mozilla.org/show_bug.cgi?id=253942Exploit
- http://marc.info/?l=bugtraq&m=109698896104418&w=2
- http://secunia.com/advisories/12526
- http://security.gentoo.org/glsa/glsa-200409-26.xml
- http://www.kb.cert.org/vuls/id/113192Third Party Advisory, US Government Resource
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
- http://www.novell.com/linux/security/advisories/2004_36_mozilla.htmlVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17377
- http://bugzilla.mozilla.org/show_bug.cgi?id=253942Exploit
- http://marc.info/?l=bugtraq&m=109698896104418&w=2
- http://secunia.com/advisories/12526
- http://security.gentoo.org/glsa/glsa-200409-26.xml
- http://www.kb.cert.org/vuls/id/113192Third Party Advisory, US Government Resource
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
- http://www.novell.com/linux/security/advisories/2004_36_mozilla.htmlVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17377
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.