CVE-2005-2261

Firefox - Remote Code Execution via XBL Scripts

Title source: llm
STIX 2.1

Description

Firefox before 1.0.5, Thunderbird before 1.0.5, Mozilla before 1.7.9, Netscape 8.0.2, and K-Meleon 0.9 runs XBL scripts even when Javascript has been disabled, which makes it easier for remote attackers to bypass such protection.

References (23)

Core 23
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A808
Issue Tracking vendor-advisory x_refsource_fedora
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=160202
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2005-587.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2005-601.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2005/dsa-810
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2005_18_sr.html
Third Party Advisory, US Government Resource third-party-advisory government-resource x_refsource_ciac
http://www.ciac.org/ciac/bulletins/p-252.shtml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19823
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16059
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16044
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2005/1075
Exploit, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=292591
Patch, Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/mfsa2005-46.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10947
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2005_45_mozilla.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1348
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/14242
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2005-586.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/16043
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100012
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_04_25.html
Exploit, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=292589

Scores

EPSS 0.0359
EPSS Percentile 88.2%

Details

Status published
Products (38)
mozilla/firefox 0.8
mozilla/firefox 0.9 (2 CPE variants)
mozilla/firefox 0.9.1
mozilla/firefox 0.9.2
mozilla/firefox 0.9.3
mozilla/firefox 0.10
mozilla/firefox 0.10.1
mozilla/firefox 1.0
mozilla/firefox 1.0.1
mozilla/firefox 1.0.2
... and 28 more
Published Jul 13, 2005
Tracked Since Feb 18, 2026