Login Request a demo
Unscored severity · published Dec 31, 2004
CVE-2004-0909
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions,…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mozilla · Mozilla
0.8; 0.9.2; 0.9.2.1; 0.9.3; 0.9.4; 0.9.4.1; +34 more · source: NVD
TH
Thunderbird · Mozilla
0.1; 0.2; 0.3; 0.4; 0.5; 0.6; +3 more · source: NVD
Affected product
MO
Mozilla
Mozilla
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0909
Exploit
http://bugzilla.mozilla.org/show_bug.cgi?id=253942
marc.info
http://marc.info/?l=bugtraq&m=109698896104418&w=2
secunia.com
http://secunia.com/advisories/12526
security.gentoo.org
http://security.gentoo.org/glsa/glsa-200409-26.xml
Third Party Advisory
http://www.kb.cert.org/vuls/id/113192
www.mozilla.org
http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
More from Mozilla
9.8
CVE-2007-4039
Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary…
9.8
CVE-2003-0791
The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw…
6.5
CVE-2005-0587
Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK (link) file twice, which…
–
CVE-2009-3014
Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within…
–
CVE-2009-3010
Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP…