Description
Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages.
Product(s):
- Mozilla Mozilla Browser 0.8
- Mozilla Mozilla Browser 0.9.2.1
- Mozilla Mozilla Browser 0.9.2
- Mozilla Mozilla Browser 0.9.35
- Mozilla Mozilla Browser 0.9.3
- Mozilla Mozilla Browser 0.9.4.1
- Mozilla Mozilla Browser 0.9.48
- Mozilla Mozilla Browser 0.9.4
- Mozilla Mozilla Browser 0.9.5
- Mozilla Mozilla Browser 0.9.6
- Mozilla Mozilla 0.9.7
- Mozilla Mozilla Browser 0.9.8
- Mozilla Mozilla 0.9.9
- Mozilla Mozilla Browser 1.0.1
- Mozilla Mozilla Browser 1.0.2
- Mozilla Mozilla 1.0
- Mozilla 1.0 RC1
- Mozilla 1.0 RC2
- Mozilla Mozilla 1.1
- Mozilla Mozilla Browser 1.1 Alpha
- Mozilla Mozilla Browser 1.1 Beta
- Mozilla Mozilla Browser 1.2.1
- Mozilla Mozilla 1.2
- Mozilla Mozilla Browser 1.2 Alpha
- Mozilla Mozilla Browser 1.2 Beta
- Mozilla Mozilla Browser 1.3.1
- Mozilla Mozilla 1.3
- Mozilla Mozilla 1.4.1
- Mozilla Mozilla Browser 1.4.2
- Mozilla Mozilla Browser 1.4.4
- Mozilla Mozilla 1.4
- Mozilla Mozilla 1.4a
- Mozilla Mozilla Browser 1.4b
- Mozilla Mozilla 1.5.1
- Mozilla Mozilla 1.5
- Mozilla Mozilla 1.5 alpha
- Mozilla Mozilla 1.5 rc1
- Mozilla Mozilla 1.5 rc2
- Mozilla Mozilla 1.6
- Mozilla Mozilla 1.6 alpha
- Mozilla Mozilla 1.6 beta
- Mozilla Mozilla 1.7.1
- Mozilla Mozilla 1.7.2
- Mozilla Mozilla 1.7
- Mozilla Mozilla 1.7 alpha
- Mozilla Mozilla 1.7 beta
- Mozilla Mozilla 1.7 rc1
- Mozilla Mozilla 1.7 rc2
- Mozilla Mozilla 1.7 rc3
- Mozilla Thunderbird 0.1
- Mozilla Thunderbird 0.2
- Mozilla Thunderbird 0.3
- Mozilla Thunderbird 0.4
- Mozilla Thunderbird 0.5
- Mozilla Thunderbird 0.6
- Mozilla Thunderbird 0.7.1
- Mozilla Thunderbird 0.7.2
- Mozilla Thunderbird 0.7
- Mozilla Thunderbird 0.7 Release Candidate
Question to Ask Vendors:
- Can you confirm whether your systems are affected by CVE-2004-0909, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2004-0909 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions:
- Check out the advisory links provided below.