CVE-2005-1477: mozilla firefox
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2005-1477 is a medium (CVSS 5.1) vulnerability in mozilla firefox. EPSS estimates a 15.24% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 09-05-2005PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
15.24%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 15.24% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (greyhatsecurity.org)
Maturity: unknown
Exploit Reference (greyhatsecurity.org)
Maturity: unknown
Mozilla Firefox 1.0.3 - Install Method Arbitrary Code Execution
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mozilla1 product
- firefox1.0.3
1 vendor · 1 product
References
18 links- bugzilla.mozilla.org/show_bug.cgi?id=292691X Refsource MISC
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9231VDB EntrySignatureX Refsource OVAL
- bugzilla.mozilla.org/show_bug.cgi?id=293302X Refsource MISC
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100001VDB EntrySignatureX Refsource OVAL
Show all 18 references
- www.mozilla.org/security/announce/mfsa2005-42.htmlX Refsource CONFIRM