CVE-2005-1477

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-05-09 · updated 2026-06-16

Description

The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

Affected products

Mozilla Firefox: 1.0.3

References

http://greyhatsecurity.org/firefox.htm
http://greyhatsecurity.org/vulntests/ffrc.htm
http://marc.info/?l=full-disclosure&m=111553138007647&w=2
http://marc.info/?l=full-disclosure&m=111556301530553&w=2
http://secunia.com/advisories/15292
http://securitytracker.com/id?1013913
http://www.kb.cert.org/vuls/id/648758
http://www.mozilla.org/security/announce/mfsa2005-42.html
http://www.redhat.com/support/errata/RHSA-2005-434.html
http://www.redhat.com/support/errata/RHSA-2005-435.html
http://www.securityfocus.com/bid/13544

Get alerted when CVE-2005-1477 or the next vulnerability affects your stack