CVE-2004-0909

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages.

Affected products

Mozilla: 0.8, 0.9.2, 0.9.2.1, 0.9.3, 0.9.4, 0.9.4.1 (+38)
Mozilla Thunderbird: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6 (+3)

References

http://bugzilla.mozilla.org/show_bug.cgi?id=253942
http://marc.info/?l=bugtraq&m=109698896104418&w=2
http://secunia.com/advisories/12526
http://security.gentoo.org/glsa/glsa-200409-26.xml
http://www.kb.cert.org/vuls/id/113192
http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/17377
http://bugzilla.mozilla.org/show_bug.cgi?id=253942
http://marc.info/?l=bugtraq&m=109698896104418&w=2
http://secunia.com/advisories/12526
http://security.gentoo.org/glsa/glsa-200409-26.xml

Get alerted when CVE-2004-0909 or the next vulnerability affects your stack