CVE-2005-0401

Firefox 1.0.1 and Mozilla < 1.7.6 - Remote Code Execution via XUL Injection

Title source: llm

Description

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."

References (12)

Core 12

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2005-336.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2005/0296

Exploit x_refsource_misc

http://mikx.de/firescrolling2/

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2005-335.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9650

Various Sources x_refsource_confirm

http://www.mozilla.org/security/announce/mfsa2005-32.html

Exploit, Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/12885

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100026

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2005-384.html

Vendor Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=111168413007891&w=2

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/14654

Scores

EPSS 0.0331

EPSS Percentile 87.2%

Details

Status published

Products (19)

mozilla/firefox 0.8

mozilla/firefox 0.9 (2 CPE variants)

mozilla/firefox 0.9.1

mozilla/firefox 0.9.2

mozilla/firefox 0.9.3

mozilla/firefox 0.10

mozilla/firefox 0.10.1

mozilla/firefox 1.0

mozilla/mozilla 1.3

mozilla/mozilla 1.4 (2 CPE variants)

... and 9 more

Published May 02, 2005

Tracked Since Feb 18, 2026