CVE-2005-0401 — Mozilla Firefox vulnerability

6 documents6 sources
Severity
5.1MEDIUMNVD
EPSS
3.9%
top 11.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla
Timeline
PublishedMay 2
Latest updateMay 1

Description

FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka "Firescrolling 2."

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages2 packages

▶NVDmozilla/firefox8 versions+7
▶NVDmozilla/mozilla11 versions+10

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-p4xc-fq3x-cx45: FireFox 1↗2022-05-01
▶
CVEList
CVE-2005-0401: FireFox 1↗2005-03-24
▶

📋Vendor Advisories

2
Ubuntu
Ubuntu 4.10 update for Firefox vulnerabilities↗2005-07-28
▶
Red Hat
security flaw↗2005-03-23
▶

💬Community

1
Bugzilla
CVE-2005-0401 security flaw↗2018-08-16
▶