Vulnerability-Lookup

CVE-2004-0764 (GCVE-0-2004-0764)

Vulnerability from cvelistv5 – Published: 2004-08-03 04:00 – Updated: 2024-08-08 00:31

Summary

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

13 references

URL	Tags
http://secunia.com/advisories/12188	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-20…	vendor-advisoryx_refsource_SCO
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
http://www.redhat.com/support/errata/RHSA-2004-421.html	vendor-advisoryx_refsource_REDHAT
http://www.mozilla.org/projects/security/known-vu…	x_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=109900315219363&w=2	vendor-advisoryx_refsource_FEDORA
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.securityfocus.com/bid/15495	vdb-entryx_refsource_BID
http://www.kb.cert.org/vuls/id/262350	third-party-advisoryx_refsource_CERT-VN
http://www.securityfocus.com/bid/10832	vdb-entryx_refsource_BID
http://bugzilla.mozilla.org/show_bug.cgi?id=244965	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL

Date Public ?

2004-07-30 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T00:31:47.321Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "12188",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/12188"
          },
          {
            "name": "mozilla-user-interface-spoofing(16837)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
          },
          {
            "name": "SCOSA-2005.49",
            "tags": [
              "vendor-advisory",
              "x_refsource_SCO",
              "x_transferred"
            ],
            "url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
          },
          {
            "name": "SUSE-SA:2004:036",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
          },
          {
            "name": "RHSA-2004:421",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
          },
          {
            "name": "FLSA:2089",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
          },
          {
            "name": "oval:org.mitre.oval:def:2418",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
          },
          {
            "name": "15495",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/15495"
          },
          {
            "name": "VU#262350",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/262350"
          },
          {
            "name": "10832",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/10832"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
          },
          {
            "name": "oval:org.mitre.oval:def:9419",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2004-07-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "12188",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/12188"
        },
        {
          "name": "mozilla-user-interface-spoofing(16837)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
        },
        {
          "name": "SCOSA-2005.49",
          "tags": [
            "vendor-advisory",
            "x_refsource_SCO"
          ],
          "url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
        },
        {
          "name": "SUSE-SA:2004:036",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
        },
        {
          "name": "RHSA-2004:421",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
        },
        {
          "name": "FLSA:2089",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
        },
        {
          "name": "oval:org.mitre.oval:def:2418",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
        },
        {
          "name": "15495",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/15495"
        },
        {
          "name": "VU#262350",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/262350"
        },
        {
          "name": "10832",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/10832"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
        },
        {
          "name": "oval:org.mitre.oval:def:9419",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2004-0764",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "12188",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/12188"
            },
            {
              "name": "mozilla-user-interface-spoofing(16837)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
            },
            {
              "name": "SCOSA-2005.49",
              "refsource": "SCO",
              "url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
            },
            {
              "name": "SUSE-SA:2004:036",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
            },
            {
              "name": "RHSA-2004:421",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
            },
            {
              "name": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
            },
            {
              "name": "FLSA:2089",
              "refsource": "FEDORA",
              "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
            },
            {
              "name": "oval:org.mitre.oval:def:2418",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
            },
            {
              "name": "15495",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/15495"
            },
            {
              "name": "VU#262350",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/262350"
            },
            {
              "name": "10832",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/10832"
            },
            {
              "name": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965",
              "refsource": "CONFIRM",
              "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
            },
            {
              "name": "oval:org.mitre.oval:def:9419",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2004-0764",
    "datePublished": "2004-08-03T04:00:00.000Z",
    "dateReserved": "2004-08-02T00:00:00.000Z",
    "dateUpdated": "2024-08-08T00:31:47.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2004-0764",
      "date": "2026-05-24",
      "epss": "0.04294",
      "percentile": "0.88988"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"0.9\", \"matchCriteriaId\": \"FF711F75-74B8-4CF6-9580-8B51F5A2F2EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.7\", \"matchCriteriaId\": \"A9239E8A-8155-462A-A409-D66FF6B94B04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"0.7\", \"matchCriteriaId\": \"5723A6C5-70AB-4F54-BCCB-DD3498446AD2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \\\"chrome\\\" flag and XML User Interface Language (XUL) files.\"}, {\"lang\": \"es\", \"value\": \"Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, permiten a sitios web remotos secuestrar el interfaz del usuario mediante la bandera \\\"chrome\\\" y ficheros de Interfaz de Usuario XML (XUL).\"}]",
      "id": "CVE-2004-0764",
      "lastModified": "2024-11-20T23:49:21.210",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 10.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": true, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2004-08-18T04:00:00.000",
      "references": "[{\"url\": \"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://bugzilla.mozilla.org/show_bug.cgi?id=244965\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/12188\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.kb.cert.org/vuls/id/262350\", \"source\": \"cve@mitre.org\", \"tags\": [\"US Government Resource\"]}, {\"url\": \"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-421.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/10832\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/15495\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/16837\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419\", \"source\": \"cve@mitre.org\"}, {\"url\": \"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://bugzilla.mozilla.org/show_bug.cgi?id=244965\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/12188\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.kb.cert.org/vuls/id/262350\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"US Government Resource\"]}, {\"url\": \"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-421.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/10832\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/15495\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/16837\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2004-0764\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2004-08-18T04:00:00.000\",\"lastModified\":\"2026-04-16T00:27:16.627\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \\\"chrome\\\" flag and XML User Interface Language (XUL) files.\"},{\"lang\":\"es\",\"value\":\"Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, permiten a sitios web remotos secuestrar el interfaz del usuario mediante la bandera \\\"chrome\\\" y ficheros de Interfaz de Usuario XML (XUL).\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":true,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.9\",\"matchCriteriaId\":\"FF711F75-74B8-4CF6-9580-8B51F5A2F2EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.7\",\"matchCriteriaId\":\"A9239E8A-8155-462A-A409-D66FF6B94B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"0.7\",\"matchCriteriaId\":\"5723A6C5-70AB-4F54-BCCB-DD3498446AD2\"}]}]}],\"references\":[{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://bugzilla.mozilla.org/show_bug.cgi?id=244965\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/12188\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.kb.cert.org/vuls/id/262350\",\"source\":\"cve@mitre.org\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-421.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/10832\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/15495\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/16837\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419\",\"source\":\"cve@mitre.org\"},{\"url\":\"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://bugzilla.mozilla.org/show_bug.cgi?id=244965\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/12188\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.kb.cert.org/vuls/id/262350\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]},{\"url\":\"http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.novell.com/linux/security/advisories/2004_36_mozilla.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-421.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/10832\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/15495\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/16837\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}

FKIE_CVE-2004-0764

Vulnerability from fkie_nvd - Published: 2004-08-18 04:00 - Updated: 2026-04-16 00:27

Severity ?

Summary

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.

References

URL	Tags
cve@mitre.org	ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt
cve@mitre.org	http://bugzilla.mozilla.org/show_bug.cgi?id=244965	Patch, Vendor Advisory
cve@mitre.org	http://marc.info/?l=bugtraq&m=109900315219363&w=2
cve@mitre.org	http://secunia.com/advisories/12188
cve@mitre.org	http://www.kb.cert.org/vuls/id/262350	US Government Resource
cve@mitre.org	http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7
cve@mitre.org	http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2004-421.html
cve@mitre.org	http://www.securityfocus.com/bid/10832
cve@mitre.org	http://www.securityfocus.com/bid/15495
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/16837
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419
af854a3a-2127-422b-91ae-364da2661108	ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt
af854a3a-2127-422b-91ae-364da2661108	http://bugzilla.mozilla.org/show_bug.cgi?id=244965	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://marc.info/?l=bugtraq&m=109900315219363&w=2
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/12188
af854a3a-2127-422b-91ae-364da2661108	http://www.kb.cert.org/vuls/id/262350	US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7
af854a3a-2127-422b-91ae-364da2661108	http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2004-421.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/10832
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/15495
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/16837
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419

Impacted products

Vendor	Product	Version
mozilla	firefox	*
mozilla	mozilla	*
mozilla	thunderbird	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF711F75-74B8-4CF6-9580-8B51F5A2F2EF",
              "versionEndIncluding": "0.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9239E8A-8155-462A-A409-D66FF6B94B04",
              "versionEndIncluding": "1.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5723A6C5-70AB-4F54-BCCB-DD3498446AD2",
              "versionEndIncluding": "0.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files."
    },
    {
      "lang": "es",
      "value": "Mozilla anteriores a 1.7, Firefox anteriores a 0.9, y Thunderbird anteriores a 0.7, permiten a sitios web remotos secuestrar el interfaz del usuario mediante la bandera \"chrome\" y ficheros de Interfaz de Usuario XML (XUL)."
    }
  ],
  "id": "CVE-2004-0764",
  "lastModified": "2026-04-16T00:27:16.627",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2004-08-18T04:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/12188"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/262350"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/10832"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/15495"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/12188"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/262350"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/10832"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/15495"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-PW9H-WWM9-4H36

Vulnerability from github – Published: 2022-05-03 03:13 – Updated: 2022-05-03 03:13

Details

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2004-0764"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2004-08-18T04:00:00Z",
    "severity": "HIGH"
  },
  "details": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files.",
  "id": "GHSA-pw9h-wwm9-4h36",
  "modified": "2022-05-03T03:13:09Z",
  "published": "2022-05-03T03:13:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
    },
    {
      "type": "WEB",
      "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/12188"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/262350"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/10832"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/15495"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2004-0764

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.

Aliases

CVE-2004-0764

Aliases

CVE-2004-0764

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2004-0764",
    "description": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files.",
    "id": "GSD-2004-0764",
    "references": [
      "https://www.suse.com/security/cve/CVE-2004-0764.html",
      "https://access.redhat.com/errata/RHSA-2004:421"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2004-0764"
      ],
      "details": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files.",
      "id": "GSD-2004-0764",
      "modified": "2023-12-13T01:22:54.047293Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2004-0764",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "12188",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/12188"
          },
          {
            "name": "mozilla-user-interface-spoofing(16837)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
          },
          {
            "name": "SCOSA-2005.49",
            "refsource": "SCO",
            "url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
          },
          {
            "name": "SUSE-SA:2004:036",
            "refsource": "SUSE",
            "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
          },
          {
            "name": "RHSA-2004:421",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
          },
          {
            "name": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7",
            "refsource": "CONFIRM",
            "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
          },
          {
            "name": "FLSA:2089",
            "refsource": "FEDORA",
            "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
          },
          {
            "name": "oval:org.mitre.oval:def:2418",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
          },
          {
            "name": "15495",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/15495"
          },
          {
            "name": "VU#262350",
            "refsource": "CERT-VN",
            "url": "http://www.kb.cert.org/vuls/id/262350"
          },
          {
            "name": "10832",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/10832"
          },
          {
            "name": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965",
            "refsource": "CONFIRM",
            "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
          },
          {
            "name": "oval:org.mitre.oval:def:9419",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.9",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.7",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.7",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2004-0764"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
            },
            {
              "name": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7"
            },
            {
              "name": "RHSA-2004:421",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2004-421.html"
            },
            {
              "name": "SUSE-SA:2004:036",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://www.novell.com/linux/security/advisories/2004_36_mozilla.html"
            },
            {
              "name": "VU#262350",
              "refsource": "CERT-VN",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.kb.cert.org/vuls/id/262350"
            },
            {
              "name": "10832",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/10832"
            },
            {
              "name": "12188",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/12188"
            },
            {
              "name": "SCOSA-2005.49",
              "refsource": "SCO",
              "tags": [],
              "url": "ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt"
            },
            {
              "name": "15495",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/15495"
            },
            {
              "name": "FLSA:2089",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://marc.info/?l=bugtraq\u0026m=109900315219363\u0026w=2"
            },
            {
              "name": "mozilla-user-interface-spoofing(16837)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16837"
            },
            {
              "name": "oval:org.mitre.oval:def:9419",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9419"
            },
            {
              "name": "oval:org.mitre.oval:def:2418",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2418"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": true,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2017-10-11T01:29Z",
      "publishedDate": "2004-08-18T04:00Z"
    }
  }
}

RHSA-2004:421

Vulnerability from csaf_redhat - Published: 2004-08-04 21:51 - Updated: 2004-08-04 00:00

Summary

Red Hat Security Advisory: mozilla security update

Severity

Critical

Notes

Topic: Updated mozilla packages based on version 1.4.3 that fix a number of security issues for Red Hat Enterprise Linux are now available.

Details: Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. A number of flaws have been found in Mozilla 1.4 that have been fixed in the Mozilla 1.4.3 release: Zen Parse reported improper input validation to the SOAPParameter object constructor leading to an integer overflow and controllable heap corruption. Malicious JavaScript could be written to utilize this flaw and could allow arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0722 to this issue. During a source code audit, Chris Evans discovered a buffer overflow and integer overflows which affect the libpng code inside Mozilla. An attacker could create a carefully crafted PNG file in such a way that it would cause Mozilla to crash or execute arbitrary code when the image was viewed. (CAN-2004-0597, CAN-2004-0599) Zen Parse reported a flaw in the POP3 capability. A malicious POP3 server could send a carefully crafted response that would cause a heap overflow and potentially allow execution of arbitrary code as the user running Mozilla. (CAN-2004-0757) Marcel Boesch found a flaw that allows a CA certificate to be imported with a DN the same as that of the built-in CA root certificates, which can cause a denial of service to SSL pages, as the malicious certificate is treated as invalid. (CAN-2004-0758) Met - Martin Hassman reported a flaw in Mozilla that could allow malicious Javascript code to upload local files from a users machine without requiring confirmation. (CAN-2004-0759) Mindlock Security reported a flaw in ftp URI handling. By using a NULL character (%00) in a ftp URI, Mozilla can be confused into opening a resource as a different MIME type. (CAN-2004-0760) Mozilla does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates website spoofing and other attacks, also known as the frame injection vulnerability. (CAN-2004-0718) Tolga Tarhan reported a flaw that can allow a malicious webpage to use a redirect sequence to spoof the security lock icon that makes a webpage appear to be encrypted. (CAN-2004-0761) Jesse Ruderman reported a security issue that affects a number of browsers including Mozilla that could allow malicious websites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box. (CAN-2004-0762) Emmanouel Kellinis discovered a caching flaw in Mozilla which allows malicious websites to spoof certificates of trusted websites via redirects and Javascript that uses the "onunload" method. (CAN-2004-0763) Mozilla allowed malicious websites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files. (CAN-2004-0764) The cert_TestHostName function in Mozilla only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN). This flaw could be used for spoofing if an attacker had control of machines on a default DNS search path. (CAN-2004-0765) All users are advised to update to these erratum packages which contain a snapshot of Mozilla 1.4.3 including backported fixes and are not vulnerable to these issues.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2004-0597

Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Critical

CVE-2004-0599

Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0718

The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Moderate

CVE-2004-0722

Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Critical

CVE-2004-0757

Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0758

Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Moderate

CVE-2004-0759

Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an <input type="file"> tag.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0760

Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Low

CVE-2004-0761

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0762

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0763

Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Moderate

CVE-2004-0764

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0765

The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Low

References

67 references

URL	Category
https://access.redhat.com/errata/RHSA-2004:421	self
https://access.redhat.com/security/updates/classi…	external
http://bugzilla.mozilla.org/show_bug.cgi?id=236618	external
http://bugzilla.mozilla.org/show_bug.cgi?id=251381	external
http://bugzilla.mozilla.org/show_bug.cgi?id=229374	external
http://bugzilla.mozilla.org/show_bug.cgi?id=249004	external
http://bugzilla.mozilla.org/show_bug.cgi?id=241924	external
http://bugzilla.mozilla.org/show_bug.cgi?id=250906	external
http://bugzilla.mozilla.org/show_bug.cgi?id=246448	external
http://bugzilla.mozilla.org/show_bug.cgi?id=240053	external
http://bugzilla.mozilla.org/show_bug.cgi?id=162020	external
http://bugzilla.mozilla.org/show_bug.cgi?id=253121	external
http://bugzilla.mozilla.org/show_bug.cgi?id=244965	external
http://bugzilla.mozilla.org/show_bug.cgi?id=234058	external
https://access.redhat.com/security/data/csaf/v2/a…	self
https://www.cve.org/CVERecord?id=CVE-2004-0597	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0597	external
https://access.redhat.com/security/cve/CVE-2004-0597	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617235	external
https://www.cve.org/CVERecord?id=CVE-2004-0599	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0599	external
https://access.redhat.com/security/cve/CVE-2004-0599	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617237	external
https://www.cve.org/CVERecord?id=CVE-2004-0718	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0718	external
https://access.redhat.com/security/cve/CVE-2004-0718	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617256	external
https://www.cve.org/CVERecord?id=CVE-2004-0722	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0722	external
https://access.redhat.com/security/cve/CVE-2004-0722	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617258	external
https://www.cve.org/CVERecord?id=CVE-2004-0757	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0757	external
https://access.redhat.com/security/cve/CVE-2004-0757	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617270	external
https://www.cve.org/CVERecord?id=CVE-2004-0758	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0758	external
https://access.redhat.com/security/cve/CVE-2004-0758	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617271	external
https://www.cve.org/CVERecord?id=CVE-2004-0759	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0759	external
https://access.redhat.com/security/cve/CVE-2004-0759	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617272	external
https://www.cve.org/CVERecord?id=CVE-2004-0760	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0760	external
https://access.redhat.com/security/cve/CVE-2004-0760	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617273	external
https://www.cve.org/CVERecord?id=CVE-2004-0761	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0761	external
https://access.redhat.com/security/cve/CVE-2004-0761	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617274	external
https://www.cve.org/CVERecord?id=CVE-2004-0762	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0762	external
https://access.redhat.com/security/cve/CVE-2004-0762	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617275	external
https://www.cve.org/CVERecord?id=CVE-2004-0763	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0763	external
https://access.redhat.com/security/cve/CVE-2004-0763	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617276	external
https://www.cve.org/CVERecord?id=CVE-2004-0764	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0764	external
https://access.redhat.com/security/cve/CVE-2004-0764	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617277	external
https://www.cve.org/CVERecord?id=CVE-2004-0765	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0765	external
https://access.redhat.com/security/cve/CVE-2004-0765	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617278	external

Acknowledgments

Chris Evans

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 2023 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated mozilla packages based on version 1.4.3 that fix a number of\nsecurity issues for Red Hat Enterprise Linux are now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla is an open source Web browser, advanced email and newsgroup\nclient, IRC chat client, and HTML editor.\n\nA number of flaws have been found in Mozilla 1.4 that have been fixed in\nthe Mozilla 1.4.3 release: \n\nZen Parse reported improper input validation to the SOAPParameter object\nconstructor leading to an integer overflow and controllable heap\ncorruption.  Malicious JavaScript could be written to utilize this flaw and\ncould allow arbitrary code execution.  The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0722 to\nthis issue.\n\nDuring a source code audit, Chris Evans discovered a buffer overflow and\ninteger overflows which affect the libpng code inside Mozilla. An attacker\ncould create a carefully crafted PNG file in such a way that it would cause\nMozilla to crash or execute arbitrary code when the image was viewed.\n(CAN-2004-0597, CAN-2004-0599)\n\nZen Parse reported a flaw in the POP3 capability.  A malicious POP3 server\ncould send a carefully crafted response that would cause a heap overflow\nand potentially allow execution of arbitrary code as the user running\nMozilla. (CAN-2004-0757)\n\nMarcel Boesch found a flaw that allows a CA certificate to be imported with\na DN the same as that of the built-in CA root certificates, which can cause\na denial of service to SSL pages, as the malicious certificate is treated\nas invalid. (CAN-2004-0758)\n\nMet - Martin Hassman reported a flaw in Mozilla that could allow malicious\nJavascript code to upload local files from a users machine without\nrequiring confirmation. (CAN-2004-0759)\n\nMindlock Security reported a flaw in ftp URI handling.  By using a NULL\ncharacter (%00) in a ftp URI, Mozilla can be confused into opening a\nresource as a different MIME type. (CAN-2004-0760)\n\nMozilla does not properly prevent a frame in one domain from injecting\ncontent into a frame that belongs to another domain, which facilitates\nwebsite spoofing and other attacks, also known as the frame injection\nvulnerability.  (CAN-2004-0718)\n\nTolga Tarhan reported a flaw that can allow a malicious webpage to use a\nredirect sequence to spoof the security lock icon that makes a webpage\nappear to be encrypted.  (CAN-2004-0761)\n\nJesse Ruderman reported a security issue that affects a number of browsers\nincluding Mozilla that could allow malicious websites to install arbitrary\nextensions by using interactive events to manipulate the XPInstall Security\ndialog box. (CAN-2004-0762)\n\nEmmanouel Kellinis discovered a caching flaw in Mozilla which allows\nmalicious websites to spoof certificates of trusted websites via\nredirects and Javascript that uses the \"onunload\" method. (CAN-2004-0763)\n\nMozilla allowed malicious websites to hijack the user interface via the\n\"chrome\" flag and XML User Interface Language (XUL) files. (CAN-2004-0764)\n\nThe cert_TestHostName function in Mozilla only checks the hostname portion\nof a certificate when the hostname portion of the URI is not a fully\nqualified domain name (FQDN).  This flaw could be used for spoofing if an\nattacker had control of machines on a default DNS search path. (CAN-2004-0765)\n\nAll users are advised to update to these erratum packages which contain a\nsnapshot of Mozilla 1.4.3 including backported fixes and are not vulnerable\nto these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2004:421",
        "url": "https://access.redhat.com/errata/RHSA-2004:421"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2004/rhsa-2004_421.json"
      }
    ],
    "title": "Red Hat Security Advisory: mozilla security update",
    "tracking": {
      "current_release_date": "2004-08-04T00:00:00Z",
      "generator": {
        "date": "2023-06-30T19:11:00Z",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.18.0"
        }
      },
      "id": "RHSA-2004:421",
      "initial_release_date": "2004-08-04T21:51:00Z",
      "revision_history": [
        {
          "date": "2004-08-04T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "Red Hat Enterprise Linux"
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Evans"
          ]
        }
      ],
      "cve": "CVE-2004-0597",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0597",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0597"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0597",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0597"
        },
        {
          "category": "external",
          "summary": "bz#1617235: CVE-2004-0597 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
        }
      ],
      "release_date": "2004-08-04T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "CVE-2004-0597 security flaw"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Evans"
          ]
        }
      ],
      "cve": "CVE-2004-0599",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0599",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0599"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0599",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0599"
        },
        {
          "category": "external",
          "summary": "bz#1617237: CVE-2004-0599 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
        }
      ],
      "release_date": "2004-08-04T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0599 security flaw"
    },
    {
      "cve": "CVE-2004-0718",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0718",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0718"
        },
        {
          "category": "external",
          "summary": "bz#1617256: CVE-2004-0718 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
        }
      ],
      "release_date": "2004-07-01T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-0718 security flaw"
    },
    {
      "cve": "CVE-2004-0722",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0722",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0722"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0722",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0722"
        },
        {
          "category": "external",
          "summary": "bz#1617258: CVE-2004-0722 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "CVE-2004-0722 security flaw"
    },
    {
      "cve": "CVE-2004-0757",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0757",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0757"
        },
        {
          "category": "external",
          "summary": "bz#1617270: CVE-2004-0757 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0757 security flaw"
    },
    {
      "cve": "CVE-2004-0758",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0758",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0758"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0758",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0758"
        },
        {
          "category": "external",
          "summary": "bz#1617271: CVE-2004-0758 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
        }
      ],
      "release_date": "2004-07-03T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-0758 security flaw"
    },
    {
      "cve": "CVE-2004-0759",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an \u003cinput type=\"file\"\u003e tag.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0759",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0759"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0759",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0759"
        },
        {
          "category": "external",
          "summary": "bz#1617272: CVE-2004-0759 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0759 security flaw"
    },
    {
      "cve": "CVE-2004-0760",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0760",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0760"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0760",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0760"
        },
        {
          "category": "external",
          "summary": "bz#1617273: CVE-2004-0760 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
        }
      ],
      "release_date": "2004-07-11T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "CVE-2004-0760 security flaw"
    },
    {
      "cve": "CVE-2004-0761",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0761",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0761"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0761",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0761"
        },
        {
          "category": "external",
          "summary": "bz#1617274: CVE-2004-0761 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0761 security flaw"
    },
    {
      "cve": "CVE-2004-0762",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0762",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0762"
        },
        {
          "category": "external",
          "summary": "bz#1617275: CVE-2004-0762 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
        }
      ],
      "release_date": "2004-07-01T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0762 security flaw"
    },
    {
      "cve": "CVE-2004-0763",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the \"onunload\" method.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0763",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0763"
        },
        {
          "category": "external",
          "summary": "bz#1617276: CVE-2004-0763 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
        }
      ],
      "release_date": "2004-07-26T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-0763 security flaw"
    },
    {
      "cve": "CVE-2004-0764",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0764",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0764"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0764",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0764"
        },
        {
          "category": "external",
          "summary": "bz#1617277: CVE-2004-0764 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
        }
      ],
      "release_date": "2004-07-30T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0764 security flaw"
    },
    {
      "cve": "CVE-2004-0765",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0765",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0765"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0765",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0765"
        },
        {
          "category": "external",
          "summary": "bz#1617278: CVE-2004-0765 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
        }
      ],
      "release_date": "2004-02-12T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "CVE-2004-0765 security flaw"
    }
  ]
}

RHSA-2004_421

Vulnerability from csaf_redhat - Published: 2004-08-04 21:51 - Updated: 2004-08-04 00:00

Summary

Red Hat Security Advisory: mozilla security update

Severity

Critical

Notes

Topic: Updated mozilla packages based on version 1.4.3 that fix a number of security issues for Red Hat Enterprise Linux are now available.

CVE-2004-0597

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Critical

CVE-2004-0599

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0718

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Moderate

CVE-2004-0722

Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Critical

CVE-2004-0757

Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0758

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Moderate

CVE-2004-0759

Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an <input type="file"> tag.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0760

Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Low

CVE-2004-0761

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0762

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0763

Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Moderate

CVE-2004-0764

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the "chrome" flag and XML User Interface Language (XUL) files.

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Important

CVE-2004-0765

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Red Hat Enterprise Linux Red Hat		—	Vendor Fix fix

Threats

Impact Low

References

67 references

URL	Category
https://access.redhat.com/errata/RHSA-2004:421	self
https://access.redhat.com/security/updates/classi…	external
http://bugzilla.mozilla.org/show_bug.cgi?id=236618	external
http://bugzilla.mozilla.org/show_bug.cgi?id=251381	external
http://bugzilla.mozilla.org/show_bug.cgi?id=229374	external
http://bugzilla.mozilla.org/show_bug.cgi?id=249004	external
http://bugzilla.mozilla.org/show_bug.cgi?id=241924	external
http://bugzilla.mozilla.org/show_bug.cgi?id=250906	external
http://bugzilla.mozilla.org/show_bug.cgi?id=246448	external
http://bugzilla.mozilla.org/show_bug.cgi?id=240053	external
http://bugzilla.mozilla.org/show_bug.cgi?id=162020	external
http://bugzilla.mozilla.org/show_bug.cgi?id=253121	external
http://bugzilla.mozilla.org/show_bug.cgi?id=244965	external
http://bugzilla.mozilla.org/show_bug.cgi?id=234058	external
https://access.redhat.com/security/data/csaf/v2/a…	self
https://www.cve.org/CVERecord?id=CVE-2004-0597	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0597	external
https://access.redhat.com/security/cve/CVE-2004-0597	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617235	external
https://www.cve.org/CVERecord?id=CVE-2004-0599	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0599	external
https://access.redhat.com/security/cve/CVE-2004-0599	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617237	external
https://www.cve.org/CVERecord?id=CVE-2004-0718	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0718	external
https://access.redhat.com/security/cve/CVE-2004-0718	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617256	external
https://www.cve.org/CVERecord?id=CVE-2004-0722	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0722	external
https://access.redhat.com/security/cve/CVE-2004-0722	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617258	external
https://www.cve.org/CVERecord?id=CVE-2004-0757	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0757	external
https://access.redhat.com/security/cve/CVE-2004-0757	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617270	external
https://www.cve.org/CVERecord?id=CVE-2004-0758	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0758	external
https://access.redhat.com/security/cve/CVE-2004-0758	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617271	external
https://www.cve.org/CVERecord?id=CVE-2004-0759	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0759	external
https://access.redhat.com/security/cve/CVE-2004-0759	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617272	external
https://www.cve.org/CVERecord?id=CVE-2004-0760	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0760	external
https://access.redhat.com/security/cve/CVE-2004-0760	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617273	external
https://www.cve.org/CVERecord?id=CVE-2004-0761	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0761	external
https://access.redhat.com/security/cve/CVE-2004-0761	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617274	external
https://www.cve.org/CVERecord?id=CVE-2004-0762	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0762	external
https://access.redhat.com/security/cve/CVE-2004-0762	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617275	external
https://www.cve.org/CVERecord?id=CVE-2004-0763	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0763	external
https://access.redhat.com/security/cve/CVE-2004-0763	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617276	external
https://www.cve.org/CVERecord?id=CVE-2004-0764	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0764	external
https://access.redhat.com/security/cve/CVE-2004-0764	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617277	external
https://www.cve.org/CVERecord?id=CVE-2004-0765	external
https://nvd.nist.gov/vuln/detail/CVE-2004-0765	external
https://access.redhat.com/security/cve/CVE-2004-0765	external
https://bugzilla.redhat.com/show_bug.cgi?id=1617278	external

Acknowledgments

Chris Evans

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 2023 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated mozilla packages based on version 1.4.3 that fix a number of\nsecurity issues for Red Hat Enterprise Linux are now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla is an open source Web browser, advanced email and newsgroup\nclient, IRC chat client, and HTML editor.\n\nA number of flaws have been found in Mozilla 1.4 that have been fixed in\nthe Mozilla 1.4.3 release: \n\nZen Parse reported improper input validation to the SOAPParameter object\nconstructor leading to an integer overflow and controllable heap\ncorruption.  Malicious JavaScript could be written to utilize this flaw and\ncould allow arbitrary code execution.  The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0722 to\nthis issue.\n\nDuring a source code audit, Chris Evans discovered a buffer overflow and\ninteger overflows which affect the libpng code inside Mozilla. An attacker\ncould create a carefully crafted PNG file in such a way that it would cause\nMozilla to crash or execute arbitrary code when the image was viewed.\n(CAN-2004-0597, CAN-2004-0599)\n\nZen Parse reported a flaw in the POP3 capability.  A malicious POP3 server\ncould send a carefully crafted response that would cause a heap overflow\nand potentially allow execution of arbitrary code as the user running\nMozilla. (CAN-2004-0757)\n\nMarcel Boesch found a flaw that allows a CA certificate to be imported with\na DN the same as that of the built-in CA root certificates, which can cause\na denial of service to SSL pages, as the malicious certificate is treated\nas invalid. (CAN-2004-0758)\n\nMet - Martin Hassman reported a flaw in Mozilla that could allow malicious\nJavascript code to upload local files from a users machine without\nrequiring confirmation. (CAN-2004-0759)\n\nMindlock Security reported a flaw in ftp URI handling.  By using a NULL\ncharacter (%00) in a ftp URI, Mozilla can be confused into opening a\nresource as a different MIME type. (CAN-2004-0760)\n\nMozilla does not properly prevent a frame in one domain from injecting\ncontent into a frame that belongs to another domain, which facilitates\nwebsite spoofing and other attacks, also known as the frame injection\nvulnerability.  (CAN-2004-0718)\n\nTolga Tarhan reported a flaw that can allow a malicious webpage to use a\nredirect sequence to spoof the security lock icon that makes a webpage\nappear to be encrypted.  (CAN-2004-0761)\n\nJesse Ruderman reported a security issue that affects a number of browsers\nincluding Mozilla that could allow malicious websites to install arbitrary\nextensions by using interactive events to manipulate the XPInstall Security\ndialog box. (CAN-2004-0762)\n\nEmmanouel Kellinis discovered a caching flaw in Mozilla which allows\nmalicious websites to spoof certificates of trusted websites via\nredirects and Javascript that uses the \"onunload\" method. (CAN-2004-0763)\n\nMozilla allowed malicious websites to hijack the user interface via the\n\"chrome\" flag and XML User Interface Language (XUL) files. (CAN-2004-0764)\n\nThe cert_TestHostName function in Mozilla only checks the hostname portion\nof a certificate when the hostname portion of the URI is not a fully\nqualified domain name (FQDN).  This flaw could be used for spoofing if an\nattacker had control of machines on a default DNS search path. (CAN-2004-0765)\n\nAll users are advised to update to these erratum packages which contain a\nsnapshot of Mozilla 1.4.3 including backported fixes and are not vulnerable\nto these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2004:421",
        "url": "https://access.redhat.com/errata/RHSA-2004:421"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=236618"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=251381"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=229374"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=249004"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=241924"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=250906"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=246448"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=240053"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=162020"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=253121"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=244965"
      },
      {
        "category": "external",
        "summary": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058",
        "url": "http://bugzilla.mozilla.org/show_bug.cgi?id=234058"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2004/rhsa-2004_421.json"
      }
    ],
    "title": "Red Hat Security Advisory: mozilla security update",
    "tracking": {
      "current_release_date": "2004-08-04T00:00:00Z",
      "generator": {
        "date": "2023-06-30T19:11:00Z",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.18.0"
        }
      },
      "id": "RHSA-2004:421",
      "initial_release_date": "2004-08-04T21:51:00Z",
      "revision_history": [
        {
          "date": "2004-08-04T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "Red Hat Enterprise Linux"
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Evans"
          ]
        }
      ],
      "cve": "CVE-2004-0597",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0597",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0597"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0597"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0597",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0597"
        },
        {
          "category": "external",
          "summary": "bz#1617235: CVE-2004-0597 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617235"
        }
      ],
      "release_date": "2004-08-04T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "CVE-2004-0597 security flaw"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Evans"
          ]
        }
      ],
      "cve": "CVE-2004-0599",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0599",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0599"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0599"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0599",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0599"
        },
        {
          "category": "external",
          "summary": "bz#1617237: CVE-2004-0599 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617237"
        }
      ],
      "release_date": "2004-08-04T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0599 security flaw"
    },
    {
      "cve": "CVE-2004-0718",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0718"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0718",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0718"
        },
        {
          "category": "external",
          "summary": "bz#1617256: CVE-2004-0718 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617256"
        }
      ],
      "release_date": "2004-07-01T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-0718 security flaw"
    },
    {
      "cve": "CVE-2004-0722",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0722",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0722"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0722"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0722",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0722"
        },
        {
          "category": "external",
          "summary": "bz#1617258: CVE-2004-0722 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617258"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "CVE-2004-0722 security flaw"
    },
    {
      "cve": "CVE-2004-0757",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Heap-based buffer overflow in the SendUidl in the POP3 capability for Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, may allow remote POP3 mail servers to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0757",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0757"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0757"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0757",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0757"
        },
        {
          "category": "external",
          "summary": "bz#1617270: CVE-2004-0757 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617270"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0757 security flaw"
    },
    {
      "cve": "CVE-2004-0758",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0758",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0758"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0758"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0758",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0758"
        },
        {
          "category": "external",
          "summary": "bz#1617271: CVE-2004-0758 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617271"
        }
      ],
      "release_date": "2004-07-03T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-0758 security flaw"
    },
    {
      "cve": "CVE-2004-0759",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an \u003cinput type=\"file\"\u003e tag.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0759",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0759"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0759"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0759",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0759"
        },
        {
          "category": "external",
          "summary": "bz#1617272: CVE-2004-0759 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617272"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0759 security flaw"
    },
    {
      "cve": "CVE-2004-0760",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla allows remote attackers to cause Mozilla to open a URI as a different MIME type than expected via a null character (%00) in an FTP URI.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0760",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0760"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0760"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0760",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0760"
        },
        {
          "category": "external",
          "summary": "bz#1617273: CVE-2004-0760 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617273"
        }
      ],
      "release_date": "2004-07-11T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "CVE-2004-0760 security flaw"
    },
    {
      "cve": "CVE-2004-0761",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote attackers to use certain redirect sequences to spoof the security lock icon that makes a web page appear to be encrypted.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0761",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0761"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0761"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0761",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0761"
        },
        {
          "category": "external",
          "summary": "bz#1617274: CVE-2004-0761 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617274"
        }
      ],
      "release_date": "2004-07-22T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0761 security flaw"
    },
    {
      "cve": "CVE-2004-0762",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0762"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0762",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0762"
        },
        {
          "category": "external",
          "summary": "bz#1617275: CVE-2004-0762 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617275"
        }
      ],
      "release_date": "2004-07-01T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0762 security flaw"
    },
    {
      "cve": "CVE-2004-0763",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the \"onunload\" method.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0763",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0763"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0763"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0763",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0763"
        },
        {
          "category": "external",
          "summary": "bz#1617276: CVE-2004-0763 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617276"
        }
      ],
      "release_date": "2004-07-26T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "CVE-2004-0763 security flaw"
    },
    {
      "cve": "CVE-2004-0764",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to hijack the user interface via the \"chrome\" flag and XML User Interface Language (XUL) files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0764",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0764"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0764"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0764",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0764"
        },
        {
          "category": "external",
          "summary": "bz#1617277: CVE-2004-0764 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617277"
        }
      ],
      "release_date": "2004-07-30T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "CVE-2004-0764 security flaw"
    },
    {
      "cve": "CVE-2004-0765",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla",
          "text": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The cert_TestHostName function in Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2004-0765",
          "url": "https://www.cve.org/CVERecord?id=CVE-2004-0765"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0765"
        },
        {
          "category": "external",
          "summary": "CVE-2004-0765",
          "url": "https://access.redhat.com/security/cve/CVE-2004-0765"
        },
        {
          "category": "external",
          "summary": "bz#1617278: CVE-2004-0765 security flaw",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1617278"
        }
      ],
      "release_date": "2004-02-12T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.  Use Red Hat\nNetwork to download and update your packages.  To launch the Red Hat\nUpdate Agent, use the following command:\n\n    up2date\n\nFor information on how to install packages manually, refer to the\nfollowing Web page for the System Administration or Customization\nguide specific to your system:\n\n    http://www.redhat.com/docs/manuals/enterprise/",
          "product_ids": [
            "Red Hat Enterprise Linux"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2004:421"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "CVE-2004-0765 security flaw"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2004-0764 (GCVE-0-2004-0764)

FKIE_CVE-2004-0764

GHSA-PW9H-WWM9-4H36

GSD-2004-0764

RHSA-2004:421

RHSA-2004_421

Tags

Sightings

Nomenclature