Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2004-0757 (GCVE-0-2004-0757)
Vulnerability from cvelistv5 – Published: 2004-08-03 04:00 – Updated: 2024-08-08 00:31
VLAI?
EPSS
Summary
Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
Date Public ?
2004-08-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:31:47.131Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "oval:org.mitre.oval:def:11042",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
},
{
"name": "10856",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10856"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"name": "SCOSA-2005.49",
"tags": [
"vendor-advisory",
"x_refsource_SCO",
"x_transferred"
],
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
},
{
"name": "SUSE-SA:2004:036",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"name": "RHSA-2004:421",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"name": "FLSA:2089",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"name": "mozilla-senduidl-pop3-bo(16869)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"name": "15495",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/15495"
},
{
"name": "oval:org.mitre.oval:def:3250",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL",
"x_transferred"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
},
{
"name": "VU#561022",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/561022"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-08-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-10T00:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "oval:org.mitre.oval:def:11042",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
},
{
"name": "10856",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10856"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"name": "SCOSA-2005.49",
"tags": [
"vendor-advisory",
"x_refsource_SCO"
],
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
},
{
"name": "SUSE-SA:2004:036",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"name": "RHSA-2004:421",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"name": "FLSA:2089",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"name": "mozilla-senduidl-pop3-bo(16869)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"name": "15495",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/15495"
},
{
"name": "oval:org.mitre.oval:def:3250",
"tags": [
"vdb-entry",
"signature",
"x_refsource_OVAL"
],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
},
{
"name": "VU#561022",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/561022"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0757",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "oval:org.mitre.oval:def:11042",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
},
{
"name": "10856",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10856"
},
{
"name": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374",
"refsource": "CONFIRM",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"name": "SCOSA-2005.49",
"refsource": "SCO",
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
},
{
"name": "SUSE-SA:2004:036",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"name": "RHSA-2004:421",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"name": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7",
"refsource": "CONFIRM",
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"name": "FLSA:2089",
"refsource": "FEDORA",
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"name": "mozilla-senduidl-pop3-bo(16869)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"name": "15495",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15495"
},
{
"name": "oval:org.mitre.oval:def:3250",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
},
{
"name": "VU#561022",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/561022"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0757",
"datePublished": "2004-08-03T04:00:00.000Z",
"dateReserved": "2004-08-02T00:00:00.000Z",
"dateUpdated": "2024-08-08T00:31:47.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"0.9\", \"matchCriteriaId\": \"FF711F75-74B8-4CF6-9580-8B51F5A2F2EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.7\", \"matchCriteriaId\": \"A9239E8A-8155-462A-A409-D66FF6B94B04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"0.7\", \"matchCriteriaId\": \"5723A6C5-70AB-4F54-BCCB-DD3498446AD2\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.\"}, {\"lang\": \"es\", \"value\": \"Desbordamiento de b\\u00fafer basado en el mont\\u00f3n en SenUidl en la capacidad POP3 de Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, puede permitir a servidores POP3 remotos ejecutar c\\u00f3digo arbitrario.\"}]",
"id": "CVE-2004-0757",
"lastModified": "2024-11-20T23:49:20.160",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 10.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": true, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2004-08-18T04:00:00.000",
"references": "[{\"url\": \"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://bugzilla.mozilla.org/show_bug.cgi?id=229374\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/10856\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.kb.cert.org/vuls/id/561022\", \"source\": \"cve@mitre.org\", \"tags\": [\"US Government Resource\"]}, {\"url\": \"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-421.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/15495\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/16869\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250\", \"source\": \"cve@mitre.org\"}, {\"url\": \"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://bugzilla.mozilla.org/show_bug.cgi?id=229374\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/10856\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.kb.cert.org/vuls/id/561022\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"US Government Resource\"]}, {\"url\": \"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-421.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/15495\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/16869\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2004-0757\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2004-08-18T04:00:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de b\u00fafer basado en el mont\u00f3n en SenUidl en la capacidad POP3 de Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, puede permitir a servidores POP3 remotos ejecutar c\u00f3digo arbitrario.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":true,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.9\",\"matchCriteriaId\":\"FF711F75-74B8-4CF6-9580-8B51F5A2F2EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.7\",\"matchCriteriaId\":\"A9239E8A-8155-462A-A409-D66FF6B94B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.7\",\"matchCriteriaId\":\"5723A6C5-70AB-4F54-BCCB-DD3498446AD2\"}]}]}],\"references\":[{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://bugzilla.mozilla.org/show_bug.cgi?id=229374\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/10856\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.kb.cert.org/vuls/id/561022\",\"source\":\"cve@mitre.org\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-421.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/15495\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/16869\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250\",\"source\":\"cve@mitre.org\"},{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://bugzilla.mozilla.org/show_bug.cgi?id=229374\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/10856\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.kb.cert.org/vuls/id/561022\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-421.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/15495\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/16869\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
GSD-2004-0757
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2004-0757",
"description": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.",
"id": "GSD-2004-0757",
"references": [
"https://www.suse.com/security/cve/CVE-2004-0757.html",
"https://access.redhat.com/errata/RHSA-2004:421"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2004-0757"
],
"details": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.",
"id": "GSD-2004-0757",
"modified": "2023-12-13T01:22:54.601107Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0757",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "oval:org.mitre.oval:def:11042",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
},
{
"name": "10856",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10856"
},
{
"name": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374",
"refsource": "CONFIRM",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"name": "SCOSA-2005.49",
"refsource": "SCO",
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
},
{
"name": "SUSE-SA:2004:036",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"name": "RHSA-2004:421",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"name": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7",
"refsource": "CONFIRM",
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"name": "FLSA:2089",
"refsource": "FEDORA",
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"name": "mozilla-senduidl-pop3-bo(16869)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"name": "15495",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/15495"
},
{
"name": "oval:org.mitre.oval:def:3250",
"refsource": "OVAL",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
},
{
"name": "VU#561022",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/561022"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "0.7",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "0.9",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.7",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0757"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"name": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"name": "RHSA-2004:421",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"name": "SUSE-SA:2004:036",
"refsource": "SUSE",
"tags": [],
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"name": "VU#561022",
"refsource": "CERT-VN",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/561022"
},
{
"name": "10856",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/10856"
},
{
"name": "SCOSA-2005.49",
"refsource": "SCO",
"tags": [],
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
},
{
"name": "15495",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/15495"
},
{
"name": "FLSA:2089",
"refsource": "FEDORA",
"tags": [],
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"name": "mozilla-senduidl-pop3-bo(16869)",
"refsource": "XF",
"tags": [],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"name": "oval:org.mitre.oval:def:3250",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
},
{
"name": "oval:org.mitre.oval:def:11042",
"refsource": "OVAL",
"tags": [],
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2017-10-11T01:29Z",
"publishedDate": "2004-08-18T04:00Z"
}
}
}
GHSA-FFVJ-MXF9-Q65V
Vulnerability from github – Published: 2022-05-03 03:13 – Updated: 2022-05-03 03:13
VLAI?
Details
Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2004-0757"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-08-18T04:00:00Z",
"severity": "HIGH"
},
"details": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.",
"id": "GHSA-ffvj-mxf9-q65v",
"modified": "2022-05-03T03:13:08Z",
"published": "2022-05-03T03:13:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
},
{
"type": "WEB",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/10856"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/561022"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/15495"
}
],
"schema_version": "1.4.0",
"severity": []
}
RHSA-2004:421
Vulnerability from csaf_redhat - Published: 2004-08-04 21:51 - Updated: 2004-08-04 00:00Summary
Red Hat Security Advisory: mozilla security update
Severity
Critical
Notes
Topic: Updated mozilla packages based on version 1.4.3 that fix a number of
security issues for Red Hat Enterprise Linux are now available.
Details: Mozilla is an open source Web browser, advanced email and newsgroup
client, IRC chat client, and HTML editor.
A number of flaws have been found in Mozilla 1.4 that have been fixed in
the Mozilla 1.4.3 release:
Zen Parse reported improper input validation to the SOAPParameter object
constructor leading to an integer overflow and controllable heap
corruption. Malicious JavaScript could be written to utilize this flaw and
could allow arbitrary code execution. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0722 to
this issue.
During a source code audit, Chris Evans discovered a buffer overflow and
integer overflows which affect the libpng code inside Mozilla. An attacker
could create a carefully crafted PNG file in such a way that it would cause
Mozilla to crash or execute arbitrary code when the image was viewed.
(CAN-2004-0597, CAN-2004-0599)
Zen Parse reported a flaw in the POP3 capability. A malicious POP3 server
could send a carefully crafted response that would cause a heap overflow
and potentially allow execution of arbitrary code as the user running
Mozilla. (CAN-2004-0757)
Marcel Boesch found a flaw that allows a CA certificate to be imported with
a DN the same as that of the built-in CA root certificates, which can cause
a denial of service to SSL pages, as the malicious certificate is treated
as invalid. (CAN-2004-0758)
Met - Martin Hassman reported a flaw in Mozilla that could allow malicious
Javascript code to upload local files from a users machine without
requiring confirmation. (CAN-2004-0759)
Mindlock Security reported a flaw in ftp URI handling. By using a NULL
character (%00) in a ftp URI, Mozilla can be confused into opening a
resource as a different MIME type. (CAN-2004-0760)
Mozilla does not properly prevent a frame in one domain from injecting
content into a frame that belongs to another domain, which facilitates
website spoofing and other attacks, also known as the frame injection
vulnerability. (CAN-2004-0718)
Tolga Tarhan reported a flaw that can allow a malicious webpage to use a
redirect sequence to spoof the security lock icon that makes a webpage
appear to be encrypted. (CAN-2004-0761)
Jesse Ruderman reported a security issue that affects a number of browsers
including Mozilla that could allow malicious websites to install arbitrary
extensions by using interactive events to manipulate the XPInstall Security
dialog box. (CAN-2004-0762)
Emmanouel Kellinis discovered a caching flaw in Mozilla which allows
malicious websites to spoof certificates of trusted websites via
redirects and Javascript that uses the "onunload" method. (CAN-2004-0763)
Mozilla allowed malicious websites to hijack the user interface via the
"chrome" flag and XML User Interface Language (XUL) files. (CAN-2004-0764)
The cert_TestHostName function in Mozilla only checks the hostname portion
of a certificate when the hostname portion of the URI is not a fully
qualified domain name (FQDN). This flaw could be used for spoofing if an
attacker had control of machines on a default DNS search path. (CAN-2004-0765)
All users are advised to update to these erratum packages which contain a
snapshot of Mozilla 1.4.3 including backported fixes and are not vulnerable
to these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an <input type="file"> tag.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
References
Acknowledgments
Chris Evans
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 2023 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated mozilla packages based on version 1.4.3 that fix a number of\nsecurity issues for Red Hat Enterprise Linux are now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla is an open source Web browser, advanced email and newsgroup\nclient, IRC chat client, and HTML editor.\n\nA number of flaws have been found in Mozilla 1.4 that have been fixed in\nthe Mozilla 1.4.3 release: \n\nZen Parse reported improper input validation to the SOAPParameter object\nconstructor leading to an integer overflow and controllable heap\ncorruption. Malicious JavaScript could be written to utilize this flaw and\ncould allow arbitrary code execution. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0722 to\nthis issue.\n\nDuring a source code audit, Chris Evans discovered a buffer overflow and\ninteger overflows which affect the libpng code inside Mozilla. An attacker\ncould create a carefully crafted PNG file in such a way that it would cause\nMozilla to crash or execute arbitrary code when the image was viewed.\n(CAN-2004-0597, CAN-2004-0599)\n\nZen Parse reported a flaw in the POP3 capability. A malicious POP3 server\ncould send a carefully crafted response that would cause a heap overflow\nand potentially allow execution of arbitrary code as the user running\nMozilla. (CAN-2004-0757)\n\nMarcel Boesch found a flaw that allows a CA certificate to be imported with\na DN the same as that of the built-in CA root certificates, which can cause\na denial of service to SSL pages, as the malicious certificate is treated\nas invalid. (CAN-2004-0758)\n\nMet - Martin Hassman reported a flaw in Mozilla that could allow malicious\nJavascript code to upload local files from a users machine without\nrequiring confirmation. (CAN-2004-0759)\n\nMindlock Security reported a flaw in ftp URI handling. By using a NULL\ncharacter (%00) in a ftp URI, Mozilla can be confused into opening a\nresource as a different MIME type. (CAN-2004-0760)\n\nMozilla does not properly prevent a frame in one domain from injecting\ncontent into a frame that belongs to another domain, which facilitates\nwebsite spoofing and other attacks, also known as the frame injection\nvulnerability. (CAN-2004-0718)\n\nTolga Tarhan reported a flaw that can allow a malicious webpage to use a\nredirect sequence to spoof the security lock icon that makes a webpage\nappear to be encrypted. (CAN-2004-0761)\n\nJesse Ruderman reported a security issue that affects a number of browsers\nincluding Mozilla that could allow malicious websites to install arbitrary\nextensions by using interactive events to manipulate the XPInstall Security\ndialog box. (CAN-2004-0762)\n\nEmmanouel Kellinis discovered a caching flaw in Mozilla which allows\nmalicious websites to spoof certificates of trusted websites via\nredirects and Javascript that uses the \"onunload\" method. (CAN-2004-0763)\n\nMozilla allowed malicious websites to hijack the user interface via the\n\"chrome\" flag and XML User Interface Language (XUL) files. (CAN-2004-0764)\n\nThe cert_TestHostName function in Mozilla only checks the hostname portion\nof a certificate when the hostname portion of the URI is not a fully\nqualified domain name (FQDN). This flaw could be used for spoofing if an\nattacker had control of machines on a default DNS search path. (CAN-2004-0765)\n\nAll users are advised to update to these erratum packages which contain a\nsnapshot of Mozilla 1.4.3 including backported fixes and are not vulnerable\nto these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2004:421",
"url": "https://access.redhat.com/errata/RHSA-2004:421"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2004/rhsa-2004_421.json"
}
],
"title": "Red Hat Security Advisory: mozilla security update",
"tracking": {
"current_release_date": "2004-08-04T00:00:00Z",
"generator": {
"date": "2023-06-30T19:11:00Z",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.18.0"
}
},
"id": "RHSA-2004:421",
"initial_release_date": "2004-08-04T21:51:00Z",
"revision_history": [
{
"date": "2004-08-04T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_family",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "Red Hat Enterprise Linux"
}
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Chris Evans"
]
}
],
"cve": "CVE-2004-0597",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
}
],
"notes": [
{
"category": "description",
"text": "Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0597",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597"
},
{
"category": "external",
"summary": "CVE-2004-0597",
"url": "https://access.redhat.com/security/cve/CVE-2004-0597"
},
{
"category": "external",
"summary": "bz#1617235: CVE-2004-0597 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
}
],
"release_date": "2004-08-04T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "CVE-2004-0597 security flaw"
},
{
"acknowledgments": [
{
"names": [
"Chris Evans"
]
}
],
"cve": "CVE-2004-0599",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
}
],
"notes": [
{
"category": "description",
"text": "Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0599",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599"
},
{
"category": "external",
"summary": "CVE-2004-0599",
"url": "https://access.redhat.com/security/cve/CVE-2004-0599"
},
{
"category": "external",
"summary": "bz#1617237: CVE-2004-0599 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
}
],
"release_date": "2004-08-04T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0599 security flaw"
},
{
"cve": "CVE-2004-0718",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
}
],
"notes": [
{
"category": "description",
"text": "The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0718",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718"
},
{
"category": "external",
"summary": "CVE-2004-0718",
"url": "https://access.redhat.com/security/cve/CVE-2004-0718"
},
{
"category": "external",
"summary": "bz#1617256: CVE-2004-0718 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
}
],
"release_date": "2004-07-01T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CVE-2004-0718 security flaw"
},
{
"cve": "CVE-2004-0722",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
}
],
"notes": [
{
"category": "description",
"text": "Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0722",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0722"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722"
},
{
"category": "external",
"summary": "CVE-2004-0722",
"url": "https://access.redhat.com/security/cve/CVE-2004-0722"
},
{
"category": "external",
"summary": "bz#1617258: CVE-2004-0722 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "CVE-2004-0722 security flaw"
},
{
"cve": "CVE-2004-0757",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
}
],
"notes": [
{
"category": "description",
"text": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0757",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0757"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757"
},
{
"category": "external",
"summary": "CVE-2004-0757",
"url": "https://access.redhat.com/security/cve/CVE-2004-0757"
},
{
"category": "external",
"summary": "bz#1617270: CVE-2004-0757 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0757 security flaw"
},
{
"cve": "CVE-2004-0758",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0758",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0758"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758"
},
{
"category": "external",
"summary": "CVE-2004-0758",
"url": "https://access.redhat.com/security/cve/CVE-2004-0758"
},
{
"category": "external",
"summary": "bz#1617271: CVE-2004-0758 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
}
],
"release_date": "2004-07-03T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CVE-2004-0758 security flaw"
},
{
"cve": "CVE-2004-0759",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an \u003cinput type=\"file\"\u003e tag.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0759",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0759"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759"
},
{
"category": "external",
"summary": "CVE-2004-0759",
"url": "https://access.redhat.com/security/cve/CVE-2004-0759"
},
{
"category": "external",
"summary": "bz#1617272: CVE-2004-0759 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0759 security flaw"
},
{
"cve": "CVE-2004-0760",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0760",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0760"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760"
},
{
"category": "external",
"summary": "CVE-2004-0760",
"url": "https://access.redhat.com/security/cve/CVE-2004-0760"
},
{
"category": "external",
"summary": "bz#1617273: CVE-2004-0760 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
}
],
"release_date": "2004-07-11T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "CVE-2004-0760 security flaw"
},
{
"cve": "CVE-2004-0761",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0761",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0761"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761"
},
{
"category": "external",
"summary": "CVE-2004-0761",
"url": "https://access.redhat.com/security/cve/CVE-2004-0761"
},
{
"category": "external",
"summary": "bz#1617274: CVE-2004-0761 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0761 security flaw"
},
{
"cve": "CVE-2004-0762",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0762",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0762"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762"
},
{
"category": "external",
"summary": "CVE-2004-0762",
"url": "https://access.redhat.com/security/cve/CVE-2004-0762"
},
{
"category": "external",
"summary": "bz#1617275: CVE-2004-0762 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
}
],
"release_date": "2004-07-01T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0762 security flaw"
},
{
"cve": "CVE-2004-0763",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the \"onunload\" method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763"
},
{
"category": "external",
"summary": "CVE-2004-0763",
"url": "https://access.redhat.com/security/cve/CVE-2004-0763"
},
{
"category": "external",
"summary": "bz#1617276: CVE-2004-0763 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
}
],
"release_date": "2004-07-26T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CVE-2004-0763 security flaw"
},
{
"cve": "CVE-2004-0764",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0764",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0764"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764"
},
{
"category": "external",
"summary": "CVE-2004-0764",
"url": "https://access.redhat.com/security/cve/CVE-2004-0764"
},
{
"category": "external",
"summary": "bz#1617277: CVE-2004-0764 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
}
],
"release_date": "2004-07-30T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0764 security flaw"
},
{
"cve": "CVE-2004-0765",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
}
],
"notes": [
{
"category": "description",
"text": "The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0765",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0765"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765"
},
{
"category": "external",
"summary": "CVE-2004-0765",
"url": "https://access.redhat.com/security/cve/CVE-2004-0765"
},
{
"category": "external",
"summary": "bz#1617278: CVE-2004-0765 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
}
],
"release_date": "2004-02-12T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "CVE-2004-0765 security flaw"
}
]
}
RHSA-2004_421
Vulnerability from csaf_redhat - Published: 2004-08-04 21:51 - Updated: 2004-08-04 00:00Summary
Red Hat Security Advisory: mozilla security update
Severity
Critical
Notes
Topic: Updated mozilla packages based on version 1.4.3 that fix a number of
security issues for Red Hat Enterprise Linux are now available.
Details: Mozilla is an open source Web browser, advanced email and newsgroup
client, IRC chat client, and HTML editor.
A number of flaws have been found in Mozilla 1.4 that have been fixed in
the Mozilla 1.4.3 release:
Zen Parse reported improper input validation to the SOAPParameter object
constructor leading to an integer overflow and controllable heap
corruption. Malicious JavaScript could be written to utilize this flaw and
could allow arbitrary code execution. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0722 to
this issue.
During a source code audit, Chris Evans discovered a buffer overflow and
integer overflows which affect the libpng code inside Mozilla. An attacker
could create a carefully crafted PNG file in such a way that it would cause
Mozilla to crash or execute arbitrary code when the image was viewed.
(CAN-2004-0597, CAN-2004-0599)
Zen Parse reported a flaw in the POP3 capability. A malicious POP3 server
could send a carefully crafted response that would cause a heap overflow
and potentially allow execution of arbitrary code as the user running
Mozilla. (CAN-2004-0757)
Marcel Boesch found a flaw that allows a CA certificate to be imported with
a DN the same as that of the built-in CA root certificates, which can cause
a denial of service to SSL pages, as the malicious certificate is treated
as invalid. (CAN-2004-0758)
Met - Martin Hassman reported a flaw in Mozilla that could allow malicious
Javascript code to upload local files from a users machine without
requiring confirmation. (CAN-2004-0759)
Mindlock Security reported a flaw in ftp URI handling. By using a NULL
character (%00) in a ftp URI, Mozilla can be confused into opening a
resource as a different MIME type. (CAN-2004-0760)
Mozilla does not properly prevent a frame in one domain from injecting
content into a frame that belongs to another domain, which facilitates
website spoofing and other attacks, also known as the frame injection
vulnerability. (CAN-2004-0718)
Tolga Tarhan reported a flaw that can allow a malicious webpage to use a
redirect sequence to spoof the security lock icon that makes a webpage
appear to be encrypted. (CAN-2004-0761)
Jesse Ruderman reported a security issue that affects a number of browsers
including Mozilla that could allow malicious websites to install arbitrary
extensions by using interactive events to manipulate the XPInstall Security
dialog box. (CAN-2004-0762)
Emmanouel Kellinis discovered a caching flaw in Mozilla which allows
malicious websites to spoof certificates of trusted websites via
redirects and Javascript that uses the "onunload" method. (CAN-2004-0763)
Mozilla allowed malicious websites to hijack the user interface via the
"chrome" flag and XML User Interface Language (XUL) files. (CAN-2004-0764)
The cert_TestHostName function in Mozilla only checks the hostname portion
of a certificate when the hostname portion of the URI is not a fully
qualified domain name (FQDN). This flaw could be used for spoofing if an
attacker had control of machines on a default DNS search path. (CAN-2004-0765)
All users are advised to update to these erratum packages which contain a
snapshot of Mozilla 1.4.3 including backported fixes and are not vulnerable
to these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an <input type="file"> tag.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.
Vendor Fix
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
https://access.redhat.com/errata/RHSA-2004:421
References
| URL | Category | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Acknowledgments
Chris Evans
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 2023 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated mozilla packages based on version 1.4.3 that fix a number of\nsecurity issues for Red Hat Enterprise Linux are now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla is an open source Web browser, advanced email and newsgroup\nclient, IRC chat client, and HTML editor.\n\nA number of flaws have been found in Mozilla 1.4 that have been fixed in\nthe Mozilla 1.4.3 release: \n\nZen Parse reported improper input validation to the SOAPParameter object\nconstructor leading to an integer overflow and controllable heap\ncorruption. Malicious JavaScript could be written to utilize this flaw and\ncould allow arbitrary code execution. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0722 to\nthis issue.\n\nDuring a source code audit, Chris Evans discovered a buffer overflow and\ninteger overflows which affect the libpng code inside Mozilla. An attacker\ncould create a carefully crafted PNG file in such a way that it would cause\nMozilla to crash or execute arbitrary code when the image was viewed.\n(CAN-2004-0597, CAN-2004-0599)\n\nZen Parse reported a flaw in the POP3 capability. A malicious POP3 server\ncould send a carefully crafted response that would cause a heap overflow\nand potentially allow execution of arbitrary code as the user running\nMozilla. (CAN-2004-0757)\n\nMarcel Boesch found a flaw that allows a CA certificate to be imported with\na DN the same as that of the built-in CA root certificates, which can cause\na denial of service to SSL pages, as the malicious certificate is treated\nas invalid. (CAN-2004-0758)\n\nMet - Martin Hassman reported a flaw in Mozilla that could allow malicious\nJavascript code to upload local files from a users machine without\nrequiring confirmation. (CAN-2004-0759)\n\nMindlock Security reported a flaw in ftp URI handling. By using a NULL\ncharacter (%00) in a ftp URI, Mozilla can be confused into opening a\nresource as a different MIME type. (CAN-2004-0760)\n\nMozilla does not properly prevent a frame in one domain from injecting\ncontent into a frame that belongs to another domain, which facilitates\nwebsite spoofing and other attacks, also known as the frame injection\nvulnerability. (CAN-2004-0718)\n\nTolga Tarhan reported a flaw that can allow a malicious webpage to use a\nredirect sequence to spoof the security lock icon that makes a webpage\nappear to be encrypted. (CAN-2004-0761)\n\nJesse Ruderman reported a security issue that affects a number of browsers\nincluding Mozilla that could allow malicious websites to install arbitrary\nextensions by using interactive events to manipulate the XPInstall Security\ndialog box. (CAN-2004-0762)\n\nEmmanouel Kellinis discovered a caching flaw in Mozilla which allows\nmalicious websites to spoof certificates of trusted websites via\nredirects and Javascript that uses the \"onunload\" method. (CAN-2004-0763)\n\nMozilla allowed malicious websites to hijack the user interface via the\n\"chrome\" flag and XML User Interface Language (XUL) files. (CAN-2004-0764)\n\nThe cert_TestHostName function in Mozilla only checks the hostname portion\nof a certificate when the hostname portion of the URI is not a fully\nqualified domain name (FQDN). This flaw could be used for spoofing if an\nattacker had control of machines on a default DNS search path. (CAN-2004-0765)\n\nAll users are advised to update to these erratum packages which contain a\nsnapshot of Mozilla 1.4.3 including backported fixes and are not vulnerable\nto these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2004:421",
"url": "https://access.redhat.com/errata/RHSA-2004:421"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
},
{
"category": "external",
"summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058",
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2004/rhsa-2004_421.json"
}
],
"title": "Red Hat Security Advisory: mozilla security update",
"tracking": {
"current_release_date": "2004-08-04T00:00:00Z",
"generator": {
"date": "2023-06-30T19:11:00Z",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.18.0"
}
},
"id": "RHSA-2004:421",
"initial_release_date": "2004-08-04T21:51:00Z",
"revision_history": [
{
"date": "2004-08-04T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_family",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "Red Hat Enterprise Linux"
}
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Chris Evans"
]
}
],
"cve": "CVE-2004-0597",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
}
],
"notes": [
{
"category": "description",
"text": "Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0597",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597"
},
{
"category": "external",
"summary": "CVE-2004-0597",
"url": "https://access.redhat.com/security/cve/CVE-2004-0597"
},
{
"category": "external",
"summary": "bz#1617235: CVE-2004-0597 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
}
],
"release_date": "2004-08-04T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "CVE-2004-0597 security flaw"
},
{
"acknowledgments": [
{
"names": [
"Chris Evans"
]
}
],
"cve": "CVE-2004-0599",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
}
],
"notes": [
{
"category": "description",
"text": "Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0599",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599"
},
{
"category": "external",
"summary": "CVE-2004-0599",
"url": "https://access.redhat.com/security/cve/CVE-2004-0599"
},
{
"category": "external",
"summary": "bz#1617237: CVE-2004-0599 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
}
],
"release_date": "2004-08-04T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0599 security flaw"
},
{
"cve": "CVE-2004-0718",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
}
],
"notes": [
{
"category": "description",
"text": "The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0718",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718"
},
{
"category": "external",
"summary": "CVE-2004-0718",
"url": "https://access.redhat.com/security/cve/CVE-2004-0718"
},
{
"category": "external",
"summary": "bz#1617256: CVE-2004-0718 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
}
],
"release_date": "2004-07-01T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CVE-2004-0718 security flaw"
},
{
"cve": "CVE-2004-0722",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
}
],
"notes": [
{
"category": "description",
"text": "Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0722",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0722"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722"
},
{
"category": "external",
"summary": "CVE-2004-0722",
"url": "https://access.redhat.com/security/cve/CVE-2004-0722"
},
{
"category": "external",
"summary": "bz#1617258: CVE-2004-0722 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "CVE-2004-0722 security flaw"
},
{
"cve": "CVE-2004-0757",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
}
],
"notes": [
{
"category": "description",
"text": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0757",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0757"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757"
},
{
"category": "external",
"summary": "CVE-2004-0757",
"url": "https://access.redhat.com/security/cve/CVE-2004-0757"
},
{
"category": "external",
"summary": "bz#1617270: CVE-2004-0757 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0757 security flaw"
},
{
"cve": "CVE-2004-0758",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0758",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0758"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758"
},
{
"category": "external",
"summary": "CVE-2004-0758",
"url": "https://access.redhat.com/security/cve/CVE-2004-0758"
},
{
"category": "external",
"summary": "bz#1617271: CVE-2004-0758 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
}
],
"release_date": "2004-07-03T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CVE-2004-0758 security flaw"
},
{
"cve": "CVE-2004-0759",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an \u003cinput type=\"file\"\u003e tag.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0759",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0759"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759"
},
{
"category": "external",
"summary": "CVE-2004-0759",
"url": "https://access.redhat.com/security/cve/CVE-2004-0759"
},
{
"category": "external",
"summary": "bz#1617272: CVE-2004-0759 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0759 security flaw"
},
{
"cve": "CVE-2004-0760",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0760",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0760"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760"
},
{
"category": "external",
"summary": "CVE-2004-0760",
"url": "https://access.redhat.com/security/cve/CVE-2004-0760"
},
{
"category": "external",
"summary": "bz#1617273: CVE-2004-0760 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
}
],
"release_date": "2004-07-11T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "CVE-2004-0760 security flaw"
},
{
"cve": "CVE-2004-0761",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0761",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0761"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761"
},
{
"category": "external",
"summary": "CVE-2004-0761",
"url": "https://access.redhat.com/security/cve/CVE-2004-0761"
},
{
"category": "external",
"summary": "bz#1617274: CVE-2004-0761 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
}
],
"release_date": "2004-07-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0761 security flaw"
},
{
"cve": "CVE-2004-0762",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0762",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0762"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762"
},
{
"category": "external",
"summary": "CVE-2004-0762",
"url": "https://access.redhat.com/security/cve/CVE-2004-0762"
},
{
"category": "external",
"summary": "bz#1617275: CVE-2004-0762 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
}
],
"release_date": "2004-07-01T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0762 security flaw"
},
{
"cve": "CVE-2004-0763",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the \"onunload\" method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0763",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0763"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763"
},
{
"category": "external",
"summary": "CVE-2004-0763",
"url": "https://access.redhat.com/security/cve/CVE-2004-0763"
},
{
"category": "external",
"summary": "bz#1617276: CVE-2004-0763 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
}
],
"release_date": "2004-07-26T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "CVE-2004-0763 security flaw"
},
{
"cve": "CVE-2004-0764",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
}
],
"notes": [
{
"category": "description",
"text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0764",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0764"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764"
},
{
"category": "external",
"summary": "CVE-2004-0764",
"url": "https://access.redhat.com/security/cve/CVE-2004-0764"
},
{
"category": "external",
"summary": "bz#1617277: CVE-2004-0764 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
}
],
"release_date": "2004-07-30T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CVE-2004-0764 security flaw"
},
{
"cve": "CVE-2004-0765",
"ids": [
{
"system_name": "Red Hat Bugzilla",
"text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
}
],
"notes": [
{
"category": "description",
"text": "The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux"
]
},
"references": [
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2004-0765",
"url": "https://www.cve.org/CVERecord?id=CVE-2004-0765"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765"
},
{
"category": "external",
"summary": "CVE-2004-0765",
"url": "https://access.redhat.com/security/cve/CVE-2004-0765"
},
{
"category": "external",
"summary": "bz#1617278: CVE-2004-0765 security flaw",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
}
],
"release_date": "2004-02-12T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied. Use Red Hat\nNetwork to download and update your packages. To launch the Red Hat\nUpdate Agent, use the following command:\n\n up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n http://www.redhat.com/docs/manuals/enterprise/",
"product_ids": [
"Red Hat Enterprise Linux"
],
"url": "https://access.redhat.com/errata/RHSA-2004:421"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "CVE-2004-0765 security flaw"
}
]
}
FKIE_CVE-2004-0757
Vulnerability from fkie_nvd - Published: 2004-08-18 04:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt | ||
| cve@mitre.org | http://bugzilla.mozilla.org/show_bug.cgi?id=229374 | Patch, Vendor Advisory | |
| cve@mitre.org | http://marc.info/?l=bugtraq&m=109900315219363&w=2 | ||
| cve@mitre.org | http://secunia.com/advisories/10856 | ||
| cve@mitre.org | http://www.kb.cert.org/vuls/id/561022 | US Government Resource | |
| cve@mitre.org | http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7 | ||
| cve@mitre.org | http://www.novell.com/linux/security/advisories/2004_36_mozilla.html | ||
| cve@mitre.org | http://www.redhat.com/support/errata/RHSA-2004-421.html | ||
| cve@mitre.org | http://www.securityfocus.com/bid/15495 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/16869 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042 | ||
| cve@mitre.org | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250 | ||
| af854a3a-2127-422b-91ae-364da2661108 | ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://bugzilla.mozilla.org/show_bug.cgi?id=229374 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://marc.info/?l=bugtraq&m=109900315219363&w=2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/10856 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.kb.cert.org/vuls/id/561022 | US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.novell.com/linux/security/advisories/2004_36_mozilla.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.redhat.com/support/errata/RHSA-2004-421.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/15495 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/16869 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FF711F75-74B8-4CF6-9580-8B51F5A2F2EF",
"versionEndIncluding": "0.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A9239E8A-8155-462A-A409-D66FF6B94B04",
"versionEndIncluding": "1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5723A6C5-70AB-4F54-BCCB-DD3498446AD2",
"versionEndIncluding": "0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code."
},
{
"lang": "es",
"value": "Desbordamiento de b\u00fafer basado en el mont\u00f3n en SenUidl en la capacidad POP3 de Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, puede permitir a servidores POP3 remotos ejecutar c\u00f3digo arbitrario."
}
],
"id": "CVE-2004-0757",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-08-18T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/10856"
},
{
"source": "cve@mitre.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/561022"
},
{
"source": "cve@mitre.org",
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"source": "cve@mitre.org",
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/15495"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
},
{
"source": "cve@mitre.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/10856"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/561022"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/15495"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16869"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11042"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3250"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Show additional events:
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…