CVE-2004-0906

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-12-31 · updated 2026-06-16

Description

The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.

Affected products

Mozilla: 0.8, 0.9.2, 0.9.2.1, 0.9.3, 0.9.4, 0.9.4.1 (+38)
Mozilla Thunderbird: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+4)

References

http://bugzilla.mozilla.org/show_bug.cgi?id=231083
http://bugzilla.mozilla.org/show_bug.cgi?id=235781
http://secunia.com/advisories/12526/
http://security.gentoo.org/glsa/glsa-200409-26.xml
http://www.kb.cert.org/vuls/id/653160
http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
http://www.redhat.com/support/errata/RHSA-2005-323.html
http://www.securityfocus.com/bid/11192
https://exchange.xforce.ibmcloud.com/vulnerabilities/17375
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11668
http://bugzilla.mozilla.org/show_bug.cgi?id=231083

Get alerted when CVE-2004-0906 or the next vulnerability affects your stack