What’s Vulnerable › Vulnerabilities

CVE-2004-0902

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2005-01-27 · updated 2026-06-16

Description

Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via (1) the "Send page" functionality, (2) certain responses from a malicious POP3 server, or (3) a link containing a non-ASCII hostname.

Affected products

• Conectiva Linux: 9.0, 10.0
• Mozilla: 1.7, 1.7.1, 1.7.2
• Mozilla Thunderbird: 0.7, 0.7.1, 0.7.2, 0.7.3
• Red Hat Enterprise Linux: 2.1, 3.0
• RedHat Enterprise Linux Desktop: 3.0
• RedHat Fedora Core: core_1.0
• RedHat Linux: 7.3, 9.0
• RedHat Linux Advanced Workstation: 2.1
• Suse Linux: 1.0, 8, 8.1, 8.2, 9.0, 9.1

References

• http://bugzilla.mozilla.org/show_bug.cgi?id=226669
• http://bugzilla.mozilla.org/show_bug.cgi?id=245066
• http://bugzilla.mozilla.org/show_bug.cgi?id=256316
• http://bugzilla.mozilla.org/show_bug.cgi?id=258005
• http://marc.info/?l=bugtraq&m=109698896104418&w=2
• http://marc.info/?l=bugtraq&m=109900315219363&w=2
• http://security.gentoo.org/glsa/glsa-200409-26.xml
• http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
• http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
• http://www.us-cert.gov/cas/techalerts/TA04-261A.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17378
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17379

Get alerted when CVE-2004-0902 or the next vulnerability affects your stack