CVE-2005-0399
Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 15.1%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 15.12% probability · 97th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox · mozilla/mozilla · mozilla/thunderbird
- Source
- secalert@redhat.com
References
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt
- http://secunia.com/advisories/14654Patch, Vendor Advisory
- http://secunia.com/advisories/19823
- http://www.ciac.org/ciac/bulletins/p-160.shtml
- http://www.gentoo.org/security/en/glsa/glsa-200503-30.xmlVendor Advisory
- http://www.kb.cert.org/vuls/id/557948Third Party Advisory, US Government Resource
- http://www.mozilla.org/security/announce/mfsa2005-30.htmlVendor Advisory
- http://www.novell.com/linux/security/advisories/2006_04_25.html
- http://www.redhat.com/support/errata/RHSA-2005-323.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-335.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-336.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-337.htmlVendor Advisory
- http://www.securityfocus.com/bid/12881
- http://www.securityfocus.com/bid/15495
- http://www.vupen.com/english/advisories/2005/0296
- http://xforce.iss.net/xforce/alerts/id/191Vendor Advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=150877Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19269
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100028
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11377
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt
- http://secunia.com/advisories/14654Patch, Vendor Advisory
- http://secunia.com/advisories/19823
- http://www.ciac.org/ciac/bulletins/p-160.shtml
- http://www.gentoo.org/security/en/glsa/glsa-200503-30.xmlVendor Advisory
- http://www.kb.cert.org/vuls/id/557948Third Party Advisory, US Government Resource
- http://www.mozilla.org/security/announce/mfsa2005-30.htmlVendor Advisory
- http://www.novell.com/linux/security/advisories/2006_04_25.html
- http://www.redhat.com/support/errata/RHSA-2005-323.htmlVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-335.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.