The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org,…

Description

The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

Scores

EPSS (exploitation in 30 days)

15.2% · top 3.2% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (18)

• https://bugzilla.mozilla.org/show_bug.cgi?id=292691 (opens in a new tab)x_refsource_MISCx_transferred
• oval:org.mitre.oval:def:9231 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• RHSA-2005:435 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 1013913 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 15292 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 15495 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• https://bugzilla.mozilla.org/show_bug.cgi?id=293302 (opens in a new tab)x_refsource_MISCx_transferred
• 20050508 Firefox Remote Compromise Technical Details (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
• oval:org.mitre.oval:def:100001 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• 13544 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://greyhatsecurity.org/vulntests/ffrc.htm (opens in a new tab)x_refsource_MISCx_transferred
• http://www.mozilla.org/security/announce/mfsa2005-42.html (opens in a new tab)x_refsource_CONFIRMx_transferred
• mozilla-javascript-code-execution(20443) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• http://greyhatsecurity.org/firefox.htm (opens in a new tab)x_refsource_MISCx_transferred
• RHSA-2005:434 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• ADV-2005-0493 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• VU#648758 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• 20050508 Firefox Remote Compromise Leaked (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2005-1477](https://trackcve.app/badge/CVE-2005-1477.svg)](https://trackcve.app/cve/CVE-2005-1477)

Record last updated 7 Aug 2024, 21:51 UTC.