Unscored severity · published Jan 27, 2005
CVE-2004-0903
Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows…
–
CVSS
9.7%
EPSS
No
On KEV
Description
Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
2.1; 2.1; 2.1; 2.1; 2.1; 2.1; +3 more · source: NVD
EL
Enterprise Linux Desktop · Redhat
3.0 · source: NVD
FC
Fedora Core · Redhat
core_1.0 · source: NVD
LI
Linux · Redhat
7.3; 7.3; 7.3; 9.0 · source: NVD
LA
Linux Advanced Workstation · Redhat
2.1; 2.1 · source: NVD
MO
Mozilla · Mozilla
1.7; 1.7.1; 1.7.2 · source: NVD
SL
Suse Linux · Suse
1.0; 8; 8.1; 8.2; 9.0; 9.0; +2 more · source: NVD
TH
Thunderbird · Mozilla
0.7; 0.7.1; 0.7.2; 0.7.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0903
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0903
Vendor Advisory
http://bugzilla.mozilla.org/show_bug.cgi?id=257314
marc.info
http://marc.info/?l=bugtraq&m=109698896104418&w=2
marc.info
http://marc.info/?l=bugtraq&m=109900315219363&w=2
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200409-26.xml
Third Party Advisory
http://www.kb.cert.org/vuls/id/414240
www.mozilla.org
http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
More from Linux
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
–
CVE-2005-3626
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted…
–
CVE-2005-3625
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams…
–
CVE-2005-3624
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via…
–
CVE-2005-0207
Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT