CVE-2005-1477: XSS

Published May 9, 2005

Updated

The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

Affected Software

1 affected component

Mozilla Firefox=1.0.3

Remediation

Patch Available

http://secunia.com/advisories/15292

Event History

May 9, 2005

CVE Published

04:00 AM

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-1477?

CVE-2005-1477 is considered a critical vulnerability due to its potential for arbitrary code execution.

How do I fix CVE-2005-1477?

The only effective fix for CVE-2005-1477 is to upgrade Firefox to a version newer than 1.0.3.

What systems are affected by CVE-2005-1477?

CVE-2005-1477 specifically affects Firefox version 1.0.3.

What types of attacks can exploit CVE-2005-1477?

CVE-2005-1477 can be exploited via web pages that execute arbitrary JavaScript with elevated privileges.

Is CVE-2005-1477 still a concern today?

While CVE-2005-1477 mainly affects outdated systems, it could still pose a risk for users who have not updated their Firefox installations.