PT-2004-1938 · Mozilla+1 · Firefox+3

Daniel Koukola · Publicado 2004-09-24 · Atualizado 2017-10-11 · CVE-2004-0906

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to Preview Release Mozilla versions prior to 1.7.3 Thunderbird versions prior to 0.8

Description: The issue is related to the XPInstall installer setting insecure permissions for certain files within xpi packages. This could allow local users to overwrite arbitrary files or execute arbitrary code.

Recommendations: For Mozilla Firefox versions prior to Preview Release, update to the Preview Release or later to resolve the issue. For Mozilla versions prior to 1.7.3, update to version 1.7.3 or later to resolve the issue. For Thunderbird versions prior to 0.8, update to version 0.8 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2004-0906

RHSA-2005_323

Produtos afetados

Mozilla Firefox

Firefox

Red Hat

Thunderbird

Referências · 27

• http://security.gentoo.org/glsa/glsa-200409-26.xml · Aviso do Fabricante
• https://redhat.com/security/data/cve/CVE-2005-0232.html · Nota
• http://mikx.de/fireflashing · Nota
• https://redhat.com/security/data/cve/CVE-2005-0399.html · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027709.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17375 · Nota
• http://redhat.com/support/errata/RHSA-2005-323.html · Aviso do Fabricante
• http://mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3 · Nota
• https://redhat.com/security/data/cve/CVE-2004-1613.html · Nota
• https://rhn.redhat.com/errata/RHSA-2005-323.html · Nota
• https://redhat.com/security/data/cve/CVE-2005-0147.html · Nota
• http://securityfocus.com/bid/11192 · Nota
• http://kb.cert.org/vuls/id/653160 · Nota
• https://redhat.com/security/data/cve/CVE-2005-0144.html · Nota
• https://redhat.com/security/data/cve/CVE-2004-0906.html · Nota