PT-2005-1464 · Mozilla+1 · Mozilla Firefox+2

Michael Krax · Published 2005-03-23 · Updated 2018-05-03 · CVE-2005-0401

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefox version 1.0.1 Mozilla versions prior to 1.7.6

Description The issue allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar. This is related to insufficient addressing of attack vectors for loading chrome files and hijacking drag and drop events.

Recommendations For Firefox version 1.0.1, update to a version that sufficiently addresses all attack vectors for loading chrome files and hijacking drag and drop events. For Mozilla versions prior to 1.7.6, update to version 1.7.6 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2005-0401

RHSA-2005:335

RHSA-2005:336

RHSA-2005_335

RHSA-2005_336

RHSA-2005_384

Affected Products

Firefox

Mozilla Firefox

Red Hat

References · 66

• 🔥 http://securityfocus.com/bid/12885 · Exploit
• 🔥 http://mikx.de/firescrolling2 · Exploit
• http://redhat.com/support/errata/RHSA-2005-335.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200503-30.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0401 · Security Note
• http://redhat.com/support/errata/RHSA-2005-384.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-336.html · Vendor Advisory
• http://secunia.com/advisories/14654 · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2005-0146.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0141.html · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0527.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0399.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0591.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0233.html · Note