PT-2005-3190 · K Meleon+3 · K-Meleon+5

John Dalbec · Published 2005-07-13 · Updated 2017-10-11 · CVE-2005-2261

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 1.0.5 Thunderbird versions prior to 1.0.5 Mozilla versions prior to 1.7.9 Netscape version 8.0.2 K-Meleon version 0.9

Description: The issue allows remote attackers to bypass protection by running XBL scripts even when Javascript has been disabled, making it easier to exploit.

Recommendations: For Firefox versions prior to 1.0.5, update to version 1.0.5 or later. For Thunderbird versions prior to 1.0.5, update to version 1.0.5 or later. For Mozilla versions prior to 1.7.9, update to version 1.7.9 or later. For Netscape version 8.0.2, consider disabling XBL scripts until a patch is available. For K-Meleon version 0.9, consider disabling XBL scripts until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-2261

DSA-779-1

DSA-779-2

DSA-781-1

DSA-810-1

DTSA-14-1

DTSA-8-2

RHSA-2005:586

RHSA-2005:587

RHSA-2005:601

RHSA-2005_586

RHSA-2005_587

RHSA-2005_601

Affected Products

Firefox

K-Meleon

Mozilla Firefox

Netscape

Red Hat

Thunderbird

References · 59

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/mozilla_compareto.rb · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=292589 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=292591 · Exploit
• http://redhat.com/support/errata/RHSA-2005-586.html · Vendor Advisory
• http://debian.org/security/2005/dsa-810 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_18_sr.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2261 · Security Note
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=160202 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_45_mozilla.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-601.html · Vendor Advisory
• http://mozilla.org/security/announce/mfsa2005-46.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_04_25.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-587.html · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2005-2267.html · Note
• http://secunia.com/advisories/15489 · Note