PT-2005-2524 · Mozilla+1 · Firefox+2

Moz_Bug_R_A4 · Published 2005-05-12 · Updated 2017-10-11 · CVE-2005-1532

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 1.0.4 Mozilla Suite versions prior to 1.7.8

Description The issue allows remote attackers to conduct unauthorized activities due to improper limitation of privileges of Javascript eval and Script objects in the calling context. This is related to "non-DOM property overrides."

Recommendations For Firefox versions prior to 1.0.4, update to version 1.0.4 or later. For Mozilla Suite versions prior to 1.7.8, update to version 1.7.8 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2005-1532

DSA-781-1

RHSA-2005:434

RHSA-2005:435

RHSA-2005:601

RHSA-2005_434

RHSA-2005_435

RHSA-2005_601

Affected Products

Firefox

Suite

Red Hat

References · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/mozilla_compareto.rb · Exploit
• 🔥 https://exploit-db.com/exploits/25670 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1532 · Security Note
• http://redhat.com/support/errata/RHSA-2005-435.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-434.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_04_25.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-601.html · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2005-1477.html · Note
• https://rhn.redhat.com/errata/RHSA-2005-434.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100014 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10791 · Note
• http://securitytracker.com/id?1013964 · Note
• http://secunia.com/advisories/19823 · Note
• https://redhat.com/security/data/cve/CVE-2005-1159.html · Note