CVE-2005-1476

Firefox 1.0.3 - XSS

Title source: llm

Description

Firefox 1.0.3 allows remote attackers to execute arbitrary Javascript in other domains by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution when combined with CVE-2005-1477.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Edward Gagnon · htmlremotewindows

https://www.exploit-db.com/exploits/986

View Code ZIP pw:eip

References (19)

[Various Sources] ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt

[Various Sources] http://greyhatsecurity.org/firefox.htm

[Exploit] http://greyhatsecurity.org/vulntests/ffrc.htm

[Mailing List] http://marc.info/?l=full-disclosure&m=111553138007647&w=2

[Mailing List] http://marc.info/?l=full-disclosure&m=111556301530553&w=2

[Patch, Vendor Advisory] http://secunia.com/advisories/15292

[US Government Resource] http://www.kb.cert.org/vuls/id/534710

[Vendor Advisory] http://www.mozilla.org/security/announce/mfsa2005-42.html

[Vendor Advisory] http://www.redhat.com/support/errata/RHSA-2005-434.html

[Vendor Advisory] http://www.redhat.com/support/errata/RHSA-2005-435.html

[Issue Tracking] https://bugzilla.mozilla.org/show_bug.cgi?id=292691

[Issue Tracking] https://bugzilla.mozilla.org/show_bug.cgi?id=293302

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/20443

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/13544

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/15495

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100002

[Third Party Advisory, VDB Entry] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10045

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1013913

[Third Party Advisory] http://www.vupen.com/english/advisories/2005/0493

Scores

EPSS 0.4976

EPSS Percentile 97.8%

Classification

Status draft

Affected Products (1)

mozilla/firefox < 1.0.3

Timeline

Published May 09, 2005

Tracked Since Feb 18, 2026