Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2005-1477
HistoryMay 09, 2005 - 4:00 a.m.

CVE-2005-1477

2005-05-0904:00:00
mitre
web.nvd.nist.gov
46
firefox
1.0.3
install function
remote sites
arbitrary javascript
code execution
cve-2005-1477
xss
whitelist

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

AI Score

6.4

Confidence

High

EPSS

0.929

Percentile

99.0%

JSON

The install function in Firefox 1.0.3 allows remote web sites on the browser’s whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

Affected configurations

Nvd
Node
mozillafirefoxMatch1.0.3
VendorProductVersionCPE
mozillafirefox1.0.3cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*

References

Related

openvas 4
nessus 8
ubuntucve 2
freebsd 1
cve 1
cvelist 2
nvd 2
exploitdb 1
gentoo 1
checkpoint_advisories 3
cert 2
redhat 2
centos 3
openvas
openvas
Gentoo Security Advisory GLSA 200505-11 (mozilla)
2008-09-24 00:00:00
FreeBSD Ports: firefox
2008-09-04 00:00:00
Gentoo Security Advisory GLSA 200505-11 (mozilla)
2008-09-24 00:00:00
nessus
nessus
GLSA-200505-11 : Mozilla Suite, Mozilla Firefox: Remote compromise
2005-05-17 00:00:00
FreeBSD : mozilla -- code execution via javascript: IconURL vulnerability (eca6195a-c233-11d9-804c-02061b08fc24)
2005-07-13 00:00:00
Mozilla Browser < 1.7.8 Multiple Vulnerabilities
2005-05-12 00:00:00
ubuntucve
ubuntucve
CVE-2005-1477
2005-05-09 00:00:00
CVE-2005-1476
2005-05-09 00:00:00
freebsd
freebsd
mozilla -- code execution via javascript: IconURL vulnerability
2005-05-08 00:00:00
cve
cve
CVE-2005-1476
2005-05-09 04:00:00
cvelist
cvelist
CVE-2005-1477
2005-05-09 04:00:00
CVE-2005-1476
2005-05-09 04:00:00
nvd
nvd
CVE-2005-1476
2005-05-09 04:00:00
CVE-2005-1477
2005-05-09 04:00:00
exploitdb
exploitdb
Mozilla Firefox 1.0.3 - Install Method Arbitrary Code Execution
2005-05-07 00:00:00
gentoo
gentoo
Mozilla Suite, Mozilla Firefox: Remote compromise
2005-05-15 00:00:00
checkpoint_advisories
checkpoint_advisories
Mozilla Firefox IconURL Arbitrary JavaScript Execution - Ver2 (CVE-2005-1477)
2014-03-03 00:00:00
Firefox install function Cross-Site Scripting - Ver2 (CVE-2005-1477)
2014-03-03 00:00:00
Mozilla Firefox IFRAME Cross Site Scripting (CVE-2005-1476)
2009-10-05 00:00:00
cert
cert
Mozilla Firefox executes JavaScript in the "IconURL" parameter of "InstallTrigger.install()" with chrome privileges
2005-05-10 00:00:00
Mozilla fails to properly prevent "JavaScript:" URIs containing "eval()" from being executed in the context of other URIs in the history list
2005-05-10 00:00:00
redhat
redhat
(RHSA-2005:435) mozilla security update
2005-05-24 00:00:00
(RHSA-2005:434) firefox security update
2005-05-23 00:00:00
centos
centos
firefox security update
2005-05-23 11:44:36
devhelp, mozilla security update
2005-05-23 11:51:15
galeon, mozilla security update
2005-05-24 01:04:22

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

AI Score

6.4

Confidence

High

EPSS

0.929

Percentile

99.0%

JSON
Related for CVE-2005-1477
openvas4nessus8ubuntucve2freebsd1cve1cvelist2nvd2exploitdb1gentoo1checkpoint_advisories3cert2redhat2centos3