CVE-2004-0906

Mozilla <1.7.3 & Thunderbird <0.8 - Local Privilege Escalation

Title source: llm
STIX 2.1

Description

The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.

References (11)

Core 11
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2005-323.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/17375
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/11192
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11668
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/653160
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200409-26.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/12526/

Scores

EPSS 0.0042
EPSS Percentile 34.5%

Details

Status published
Products (37)
mozilla/mozilla 0.8
mozilla/mozilla 0.9.2
mozilla/mozilla 0.9.2.1
mozilla/mozilla 0.9.3
mozilla/mozilla 0.9.4
mozilla/mozilla 0.9.4.1
mozilla/mozilla 0.9.5
mozilla/mozilla 0.9.6
mozilla/mozilla 0.9.7
mozilla/mozilla 0.9.8
... and 27 more
Published Dec 31, 2004
Tracked Since Feb 18, 2026