PT-2004-3547 · Mozilla · Firefox

Naomirocks · Published 2004-12-31 · Updated 2024-08-08 · CVE-2004-2657

Positive Technologies (AI Summary)

CVSS v2.0

1.7

Low

Base vector

AV:L/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 1.5.0.1 and possibly other versions

Description The issue allows local users who share a Windows profile to view records of user activity after a new installation of Firefox, even if the previous installation was uninstalled. This is reported to affect the list of Passwords Never Saved web sites. The vendor has disputed this issue, stating that the uninstaller is not intended to remove user data.

Recommendations For Mozilla Firefox version 1.5.0.1, consider manually removing user data after uninstalling to prevent other users from accessing the records. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-2657

Affected Products

Firefox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-2657 · Security Note
• http://securityfocus.com/archive/1/431063/100/0/threaded · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=234680 · Note
• http://securityfocus.com/archive/1/431021/100/0/threaded · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=330884 · Note
• https://t.me/cvenotify/89857 · Telegram Post