Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2005-4720 — Infinite Loop in Firefox

4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
12.7%
top 6.00%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Debian FirefoxMozilla Firefox
Timeline
PublishedDec 31
Latest updateMay 1

Description

Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IFRAME element with a large value of the WIDTH attribute, which triggers a problem related to representation of floating-point numbers, leading to an infinite loop of widget resizes and a corresponding large number of function calls on the stack.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶NVDmozilla/firefox1.0.6, 1.0.7+1
▶debiandebian/firefox< firefox 1.5.dfsg-1 (sid)

Patches

Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-4677-48q7-5jfp: Mozilla Firefox 1↗2022-05-01
▶

💥Exploits & PoCs

1
Exploit-DB
Mozilla Firefox 1.0.6/1.0.7 - iFrame Handling Denial of Service↗2005-10-05
▶

📋Vendor Advisories

1
Debian
CVE-2005-4720: firefox - Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a de...↗2005
▶