Unscored severity · published Dec 31, 2004
CVE-2004-0904
Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute…
–
CVSS
8%
EPSS
No
On KEV
Description
Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.0% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefox · Mozilla
0.8; 0.9; 0.9; 0.9.1; 0.9.2; 0.9.3 · source: NVD
EL
Enterprise Linux · Redhat
2.1; 2.1; 2.1; 2.1; 2.1; 2.1; +3 more · source: NVD
EL
Enterprise Linux Desktop · Redhat
3.0 · source: NVD
FC
Fedora Core · Redhat
core_1.0 · source: NVD
LI
Linux · Redhat
7.3; 7.3; 7.3; 9.0 · source: NVD
LA
Linux Advanced Workstation · Redhat
2.1; 2.1 · source: NVD
MO
Mozilla · Mozilla
1.7; 1.7; 1.7.1; 1.7.2 · source: NVD
NA
Navigator · Netscape
7.0; 7.0.2; 7.1; 7.2 · source: NVD
TH
Thunderbird · Mozilla
0.6; 0.7; 0.7.1; 0.7.2; 0.7.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0904
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0904
Vendor Advisory
http://bugzilla.mozilla.org/show_bug.cgi?id=255067
marc.info
http://marc.info/?l=bugtraq&m=109698896104418&w=2
marc.info
http://marc.info/?l=bugtraq&m=109900315219363&w=2
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200409-26.xml
Third Party Advisory
http://www.kb.cert.org/vuls/id/847200
www.mozilla.org
http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
More from Firefox
10.0
CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
9.8
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
9.8
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
9.6
CVE-2022-26486
Mozilla Firefox Use-After-Free Vulnerability
8.8
CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability