CVE-2004-1316: Buffer Overflow
Published Dec 29, 2004
·Updated
Heap-based buffer overflow in MSGUnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated.
Affected Software
22 affected components
Mozilla Mozilla=1.7-alpha
Mozilla Mozilla=1.7-rc1
Mozilla Mozilla=1.5-rc2
Mozilla Mozilla=1.7
Mozilla Mozilla=1.6-beta
Mozilla Mozilla=1.4.1
Mozilla Mozilla=1.5-alpha
Mozilla Mozilla=1.5-rc1
Mozilla Mozilla=1.3
Mozilla Mozilla=1.7-beta
Mozilla Mozilla=1.4
Mozilla Mozilla=1.5
Mozilla Mozilla
Mozilla Mozilla=1.7.1
Mozilla Mozilla=1.4-alpha
Mozilla Mozilla=1.5.1
Mozilla Mozilla=1.7.2
Mozilla Mozilla=1.7-rc3
Mozilla Mozilla=1.7-rc2
Mozilla Mozilla=1.7.3
Mozilla Mozilla=1.6-alpha
Mozilla Mozilla=1.6
Remediation
Patch Available
Event History
Dec 29, 2004
CVE Published
05:00 AM
Dec 31, 2004
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1316?
CVE-2004-1316 has a severity that can lead to a denial of service, as it causes the application to crash.
2
How do I fix CVE-2004-1316?
To fix CVE-2004-1316, update to a version of Mozilla newer than 1.7.3.
3
Which versions of Mozilla are affected by CVE-2004-1316?
CVE-2004-1316 affects Mozilla versions 1.7.3 and earlier.
4
What type of vulnerability is CVE-2004-1316?
CVE-2004-1316 is a heap-based buffer overflow vulnerability.
5
Can CVE-2004-1316 be exploited remotely?
Yes, CVE-2004-1316 can be exploited remotely through specially crafted NNTP URLs.