What’s Vulnerable › Vulnerabilities

CVE-2004-0648

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2004-08-06 · updated 2026-06-16

Description

Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.

Affected products

• Mozilla Firefox: through 0.9.2
• Mozilla: through 1.7.1
• Mozilla Thunderbird: through 0.7.2

References

• http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023573.html
• http://marc.info/?l=bugtraq&m=108938712815719&w=2
• http://secunia.com/advisories/12027
• http://www.ciac.org/ciac/bulletins/o-175.shtml
• http://www.kb.cert.org/vuls/id/927014
• http://www.mozilla.org/projects/security/known-vulnerabilities.html
• http://www.mozilla.org/security/shell.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16655
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023573.html
• http://marc.info/?l=bugtraq&m=108938712815719&w=2
• http://secunia.com/advisories/12027
• http://www.ciac.org/ciac/bulletins/o-175.shtml

Get alerted when CVE-2004-0648 or the next vulnerability affects your stack