RHSA-2005:323
Vulnerability from csaf_redhat
Published
2005-03-23 19:01
Modified
2005-03-23 00:00
Summary
Red Hat Security Advisory: mozilla security update

Notes

Topic
Updated mozilla packages that fix various bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team.
Details
Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. A buffer overflow bug was found in the way Mozilla processes GIF images. It is possible for an attacker to create a specially crafted GIF image, which when viewed by a victim will execute arbitrary code as the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0399 to this issue. A bug was found in the way Mozilla displays dialog windows. It is possible that a malicious web page which is being displayed in a background tab could present the user with a dialog window appearing to come from the active page. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1380 to this issue. A bug was found in the way Mozilla allowed plug-ins to load privileged content into a frame. It is possible that a malicious webpage could trick a user into clicking in certain places to modify configuration settings or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0232 to this issue. A bug was found in the way Mozilla Mail handles cookies when loading content over HTTP regardless of the user's preference. It is possible that a particular user could be tracked through the use of malicious mail messages which load content over HTTP. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0149 to this issue. A bug was found in the way Mozilla responds to proxy auth requests. It is possible for a malicious webserver to steal credentials from a victims browser by issuing a 407 proxy authentication request. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0147 to this issue. A bug was found in the way Mozilla handles certain start tags followed by a NULL character. A malicious web page could cause Mozilla to crash when viewed by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1613 to this issue. A bug was found in the way Mozilla sets file permissions when installing XPI packages. It is possible for an XPI package to install some files world readable or writable, allowing a malicious local user to steal information or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0906 to this issue. A bug was found in the way Mozilla loads links in a new tab which are middle clicked. A malicious web page could read local files or modify privileged chrom settings. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0141 to this issue. A bug was found in the way Mozilla displays the secure site icon. A malicious web page can use a view-source URL targetted at a secure page, while loading an insecure page, yet the secure site icon shows the previous secure state. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0144 to this issue. Users of Mozilla are advised to upgrade to this updated package which contains Mozilla version 1.4.4 and additional backported patches to correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 2023 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated mozilla packages that fix various bugs are now available.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla is an open source Web browser, advanced email and newsgroup client,\nIRC chat client, and HTML editor.\n\nA buffer overflow bug was found in the way Mozilla processes GIF images. It\nis possible for an attacker to create a specially crafted GIF image, which\nwhen viewed by a victim will execute arbitrary code as the victim. The\nCommon Vulnerabilities and Exposures project (cve.mitre.org) has assigned\nthe name CAN-2005-0399 to this issue.\n\nA bug was found in the way Mozilla displays dialog windows. It is possible\nthat a malicious web page which is being displayed in a background tab\ncould present the user with a dialog window appearing to come from the\nactive page. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-1380 to this issue.\n\nA bug was found in the way Mozilla allowed plug-ins to load privileged\ncontent into a frame. It is possible that a malicious webpage could trick a\nuser into clicking in certain places to modify configuration settings or\nexecute arbitrary code. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0232 to this issue.\n\nA bug was found in the way Mozilla Mail handles cookies when loading\ncontent over HTTP regardless of the user\u0027s preference. It is possible that\na particular user could be tracked through the use of malicious mail\nmessages which load content over HTTP. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2005-0149 to\nthis issue.\n\nA bug was found in the way Mozilla responds to proxy auth requests. It is\npossible for a malicious webserver to steal credentials from a victims\nbrowser by issuing a 407 proxy authentication request. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2005-0147 to this issue.\n\nA bug was found in the way Mozilla handles certain start tags followed by a\nNULL character.  A malicious web page could cause Mozilla to crash when\nviewed by a victim. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-1613 to this issue.\n\nA bug was found in the way Mozilla sets file permissions when installing\nXPI packages.  It is possible for an XPI package to install some files\nworld readable or writable, allowing a malicious local user to steal\ninformation or execute arbitrary code. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0906 to\nthis issue.\n\nA bug was found in the way Mozilla loads links in a new tab which are\nmiddle clicked. A malicious web page could read local files or modify\nprivileged chrom settings. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0141 to this issue.\n\nA bug was found in the way Mozilla displays the secure site icon. A\nmalicious web page can use a view-source URL targetted at a secure page,\nwhile loading an insecure page, yet the secure site icon shows the previous\nsecure state. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2005-0144 to this issue.\n\nUsers of Mozilla are advised to upgrade to this updated package which\ncontains Mozilla version 1.4.4 and additional backported patches to correct\nthese issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2005:323",
        "url": "https://access.redhat.com/errata/RHSA-2005:323"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2005/rhsa-2005_323.json"
      }
    ],
    "title": "Red Hat Security Advisory: mozilla security update",
    "tracking": {
      "current_release_date": "2005-03-23T00:00:00Z",
      "generator": {
        "date": "2023-06-30T19:19:00Z",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.18.0"
        }
      },
      "id": "RHSA-2005:323",
      "initial_release_date": "2005-03-23T19:01:00Z",
      "revision_history": [
        {
          "date": "2005-03-23T00:00:00Z",
          "number": "2",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "Red Hat Enterprise Linux"
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2004-0906",
      "discovery_date": "2005-03-16T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617321"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0906",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0906"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0906",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0906"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0906",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0906"
        },
        {
          "category": "external",
          "summary": "bz#1617321: CVE-2004-0906 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617321"
        }
      ],
      "release_date": "2004-02-26T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-03-16T00:00:00Z",
          "details": "Low"
        }
      ],
      "title": "CVE-2004-0906 security flaw"
    },
    {
      "cve": "CVE-2004-1380",
      "discovery_date": "2005-01-20T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617409"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Firefox before 1.0 and Mozilla before 1.7.5 allows inactive (background) tabs to launch dialog boxes, which can allow remote attackers to spoof the dialog boxes from web sites in other windows and facilitate phishing attacks, aka the \"Dialog Box Spoofing Vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-1380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-1380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-1380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1380"
        },
        {
          "category": "external",
          "summary": "CVE-2004-1380",
          "url": "https://access.redhat.com/security/cve/CVE-2004-1380"
        },
        {
          "category": "external",
          "summary": "bz#1617409: CVE-2004-1380 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617409"
        }
      ],
      "release_date": "2005-01-20T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-01-20T00:00:00Z",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-1380 security flaw"
    },
    {
      "cve": "CVE-2004-1613",
      "discovery_date": "2005-03-16T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617415"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1) TEXTAREA, (2) INPUT, (3) FRAMESET or (4) IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-1613",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-1613"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-1613",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1613"
        },
        {
          "category": "external",
          "summary": "CVE-2004-1613",
          "url": "https://access.redhat.com/security/cve/CVE-2004-1613"
        },
        {
          "category": "external",
          "summary": "bz#1617415: CVE-2004-1613 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617415"
        }
      ],
      "release_date": "2004-10-18T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-03-16T00:00:00Z",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-1613 security flaw"
    },
    {
      "cve": "CVE-2005-0141",
      "discovery_date": "2005-01-20T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617469"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Firefox before 1.0 and Mozilla before 1.7.5 allow remote attackers to load local files via links \"with a custom getter and toString method\" that are middle-clicked by the user to be opened in a new tab.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-0141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-0141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0141"
        },
        {
          "category": "external",
          "summary": "CVE-2005-0141",
          "url": "https://access.redhat.com/security/cve/CVE-2005-0141"
        },
        {
          "category": "external",
          "summary": "bz#1617469: CVE-2005-0141 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617469"
        }
      ],
      "release_date": "2005-01-19T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-01-20T00:00:00Z",
          "details": "Low"
        }
      ],
      "title": "CVE-2005-0141 security flaw"
    },
    {
      "cve": "CVE-2005-0144",
      "discovery_date": "2005-01-20T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617472"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Firefox before 1.0 and Mozilla before 1.7.5 display the secure site lock icon when a view-source: URL references a secure SSL site while an insecure page is being loaded, which could facilitate phishing attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-0144",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-0144"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0144",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0144"
        },
        {
          "category": "external",
          "summary": "CVE-2005-0144",
          "url": "https://access.redhat.com/security/cve/CVE-2005-0144"
        },
        {
          "category": "external",
          "summary": "bz#1617472: CVE-2005-0144 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617472"
        }
      ],
      "release_date": "2005-01-20T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-01-20T00:00:00Z",
          "details": "Low"
        }
      ],
      "title": "CVE-2005-0144 security flaw"
    },
    {
      "cve": "CVE-2005-0147",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617474"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Firefox before 1.0 and Mozilla before 1.7.5, when configured to use a proxy, respond to 407 proxy auth requests from arbitrary servers, which allows remote attackers to steal NTLM or SPNEGO credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-0147",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-0147"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0147",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0147"
        },
        {
          "category": "external",
          "summary": "CVE-2005-0147",
          "url": "https://access.redhat.com/security/cve/CVE-2005-0147"
        },
        {
          "category": "external",
          "summary": "bz#1617474: CVE-2005-0147 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617474"
        }
      ],
      "release_date": "2005-01-20T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2005-0147 security flaw"
    },
    {
      "cve": "CVE-2005-0149",
      "discovery_date": "2005-01-26T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617475"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user\u0027s intended privacy and security policy by using cookies in e-mail messages.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-0149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-0149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0149"
        },
        {
          "category": "external",
          "summary": "CVE-2005-0149",
          "url": "https://access.redhat.com/security/cve/CVE-2005-0149"
        },
        {
          "category": "external",
          "summary": "bz#1617475: CVE-2005-0149 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617475"
        }
      ],
      "release_date": "2005-01-20T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-01-26T00:00:00Z",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2005-0149 security flaw"
    },
    {
      "cve": "CVE-2005-0232",
      "discovery_date": "2005-02-10T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617501"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Firefox 1.0 allows remote attackers to modify Boolean configuration parameters for the about:config site by using a plugin such as Flash, and the -moz-opacity filter, to display the about:config site then cause the user to double-click at a certain screen position, aka \"Fireflashing.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-0232",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-0232"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0232",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0232"
        },
        {
          "category": "external",
          "summary": "CVE-2005-0232",
          "url": "https://access.redhat.com/security/cve/CVE-2005-0232"
        },
        {
          "category": "external",
          "summary": "bz#1617501: CVE-2005-0232 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617501"
        }
      ],
      "release_date": "2005-02-07T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-02-10T00:00:00Z",
          "details": "Important"
        }
      ],
      "title": "CVE-2005-0232 security flaw"
    },
    {
      "cve": "CVE-2005-0399",
      "discovery_date": "2005-03-10T00:00:00Z",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617517"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Heap-based buffer overflow in GIF2.cpp in Firefox before 1.0.2, Mozilla before to 1.7.6, and Thunderbird before 1.0.2, and possibly other applications that use the same library, allows remote attackers to execute arbitrary code via a GIF image with a crafted Netscape extension 2 block and buffer size.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-0399",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-0399"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-0399",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-0399"
        },
        {
          "category": "external",
          "summary": "CVE-2005-0399",
          "url": "https://access.redhat.com/security/cve/CVE-2005-0399"
        },
        {
          "category": "external",
          "summary": "bz#1617517: CVE-2005-0399 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617517"
        }
      ],
      "release_date": "2005-03-23T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2005:323"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2005-03-10T00:00:00Z",
          "details": "Critical"
        }
      ],
      "title": "CVE-2005-0399 security flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.