Description
Mozilla Firefox before 0.10.1 allows remote attackers to delete arbitrary files in the download directory via a crafted data: URI that is not properly handled when the user clicks the Save button.
References (6)
Core 6
Core References
Patch vdb-entry
x_refsource_osvdb
http://www.osvdb.org/10478
Patch vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1011501
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/11311
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/12708
Various Sources x_refsource_confirm
http://www.mozilla.org/projects/security/older-vulnerabilities.html#firefox0.10.1
Patch, Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=259708
Scores
EPSS
0.0181
EPSS Percentile
76.2%
Details
Status
published
Products (7)
mozilla/firefox
0.8
mozilla/firefox
0.9 (2 CPE variants)
mozilla/firefox
0.9.1
mozilla/firefox
0.9.2
mozilla/firefox
0.9.3
mozilla/firefox
0.10
mozilla/firefox
preview_release
Published
Dec 31, 2004
Tracked Since
Feb 18, 2026