CVE-2004-0906 | BDVDB-2026-7282 Detail
Description#
The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.redhat.com/support/errata/RHSA-2005-323.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17375
- http://www.securityfocus.com/bid/11192
- http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
- http://bugzilla.mozilla.org/show_bug.cgi?id=231083
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11668
- http://www.kb.cert.org/vuls/id/653160
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
- http://security.gentoo.org/glsa/glsa-200409-26.xml
- http://secunia.com/advisories/12526/
- http://bugzilla.mozilla.org/show_bug.cgi?id=235781
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.