Critical severity · published Oct 7, 2003
CVE-2003-0791
The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw…
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mozilla · Mozilla
through 1.4 · source: NVD
OP
Openserver · Sco
5.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0791
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0791
URL Repurposed
http://secunia.com/advisories/11103/
Broken Link
http://www.mandriva.com/security/advisories?name=MDKSA-2004:021
Broken Link
http://www.osvdb.org/8390
Broken Link
http://www.securityfocus.com/advisories/6979
Broken Link
http://www.securityfocus.com/bid/9322
Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=221526
More from Mozilla
9.8
CVE-2007-4039
Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary…
6.5
CVE-2005-0587
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which…
–
CVE-2009-3014
Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within…
–
CVE-2009-3010
Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP…
–
CVE-2007-3144
Visual truncation vulnerability in Mozilla 1.7.12 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a long hostname, which is truncated…