PT-2005-1251 · Mozilla · Firefox

Omar Khan · Published 2005-01-29 · Updated 2017-10-11 · CVE-2005-0150

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 1.0

Description The issue allows remote attackers to execute arbitrary code by storing a javascript: or data: URL as a Livefeed bookmark, which is then executed in the security context of the currently loaded page when the user accesses the bookmark.

Recommendations For Firefox versions prior to 1.0, avoid storing javascript: or data: URLs as Livefeed bookmarks to minimize the risk of exploitation. As a temporary workaround, consider restricting access to Livefeed bookmarks until a fix is available.

Fix

Related Identifiers

CVE-2005-0150

Affected Products

Firefox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-0150 · Security Note
• http://mozilla.org/security/announce/mfsa2005-12.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=265668 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100046 · Note
• http://securityfocus.com/bid/12407 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19187 · Note