PT-2004-1938 · Mozilla+1 · Firefox+3

Daniel Koukola

·

Published

2004-09-24

·

Updated

2017-10-11

·

CVE-2004-0906

CVSS v2.0

4.6

Medium

VectorAV:L/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to Preview Release Mozilla versions prior to 1.7.3 Thunderbird versions prior to 0.8
Description: The issue is related to the XPInstall installer setting insecure permissions for certain files within xpi packages. This could allow local users to overwrite arbitrary files or execute arbitrary code.
Recommendations: For Mozilla Firefox versions prior to Preview Release, update to the Preview Release or later to resolve the issue. For Mozilla versions prior to 1.7.3, update to version 1.7.3 or later to resolve the issue. For Thunderbird versions prior to 0.8, update to version 0.8 or later to resolve the issue.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2004-0906
RHSA-2005_323

Affected Products

Mozilla Firefox
Firefox
Red Hat
Thunderbird