CVE-2005-0149

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-02-15 · updated 2026-06-16

Description

Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages.

Affected products

Mozilla: 1.7, 1.7-alpha, 1.7-beta, 1.7-rc1, 1.7-rc2, 1.7-rc3 (+3)
Mozilla Thunderbird: 0.6, 0.7, 0.7.1, 0.7.2, 0.7.3, 0.9

References

http://secunia.com/advisories/19823
http://www.mozilla.org/security/announce/mfsa2005-11.html
http://www.novell.com/linux/security/advisories/2006_04_25.html
http://www.redhat.com/support/errata/RHSA-2005-094.html
http://www.redhat.com/support/errata/RHSA-2005-323.html
http://www.redhat.com/support/errata/RHSA-2005-335.html
http://www.securityfocus.com/bid/12407
https://bugzilla.mozilla.org/show_bug.cgi?id=268107
https://exchange.xforce.ibmcloud.com/vulnerabilities/19172
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100047
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11407
http://secunia.com/advisories/19823

Get alerted when CVE-2005-0149 or the next vulnerability affects your stack