PT-2005-2523 · Mozilla+1 · Firefox+2

Georgi Guninski + 2 · Published 2005-05-12 · Updated 2017-10-11 · CVE-2005-1531

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 1.0.4 Mozilla Suite versions prior to 1.7.8

Description The issue is related to improper implementation of security checks for script injection, allowing remote attackers to execute scripts via javascript: URLs. This can be achieved through various methods, including using a javascript: URL in a view-source: URL, a javascript: URL in a jar: URL, or a nested variant.

Recommendations For Firefox versions prior to 1.0.4, update to version 1.0.4 or later to resolve the issue. For Mozilla Suite versions prior to 1.7.8, update to version 1.7.8 or later to resolve the issue.

Fix

Related Identifiers

CVE-2005-1531

RHSA-2005:434

RHSA-2005:435

RHSA-2005_434

RHSA-2005_435

Affected Products

Firefox

Suite

Red Hat

References · 20

• http://redhat.com/support/errata/RHSA-2005-435.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1531 · Security Note
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-434.html · Vendor Advisory
• http://mozilla.org/security/announce/mfsa2005-43.html · Patch
• https://redhat.com/security/data/cve/CVE-2005-1477.html · Note
• https://rhn.redhat.com/errata/RHSA-2005-434.html · Note
• http://greyhatsecurity.org/firefox.htm · Note
• http://securityfocus.com/bid/13641 · Note
• http://greyhatsecurity.org/vulntests/ffrc.htm · Note
• https://rhn.redhat.com/errata/RHSA-2005-435.html · Note
• http://securitytracker.com/id?1013963 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10351 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100015 · Note
• https://redhat.com/security/data/cve/CVE-2005-1476.html · Note