Description
The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mozilla-thunderbird | 1.0.2-2.sarge1.0.6 | DSA-781-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.9.2-2.4.4 | RHSA-2005:386 |
| RHEL 4 | firefox | 1.0.3-1.4.1 | RHSA-2005:383 |
| RHEL 4 | thunderbird | 1.0.6-1.4.1 | RHSA-2005:601 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Mozilla Suite/Firefox - JavaScript Lambda Replace Heap Memory Disclosure EDB-25334 · dos · Apr 4, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2005:601 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:386 Red Hat Security Advisory: Mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:383 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-781-1 mozilla-thunderbird - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:100025 vdb-entry signature
- RHSA-2005:386 vendor-advisory
- 12988 vdb-entry
- 14820 third-party-advisory
- 19823 third-party-advisory
- 15495 vdb-entry
- 1013635 vdb-entry
- RHSA-2005:601 vendor-advisory
- GLSA-200504-18 vendor-advisory
- 1013643 vdb-entry
- oval:org.mitre.oval:def:11706 vdb-entry signature
- RHSA-2005:384 vendor-advisory
- RHSA-2005:383 vendor-advisory
- SUSE-SA:2006:022 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=288688
- http://www.mozilla.org/security/announce/mfsa2005-33.html
- 14821 third-party-advisory