Description
Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, and K-Meleon 0.9, and possibly other products that use the Gecko engine, allow remote attackers to cause a denial of service (application crash) via JavaScript that repeatedly calls an empty function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.9.2-2.4.6 | RHSA-2005:587 |
| RHEL 4 | firefox | 1.0.6-1.4.1 | RHSA-2005:586 |
Advisories 2
- RHSA-2005:586 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:587 Red Hat Security Advisory: mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 1014292 vdb-entry
- http://www.securiteam.com/securitynews/5OP0U00G1G.html
- RHSA-2005:587 vendor-advisory
- 1014293 vdb-entry
- 1014294 vdb-entry
- 1014372 vdb-entry
- http://www.kurczaba.com/html/security/0506241.htm
- 20050629 Mozilla Multiple Product JavaScript Issue mailing-list
- 1014349 vdb-entry
- RHSA-2005:586 vendor-advisory
- mozilla-mult-browsers-javascript-dos(21188) vdb-entry
- oval:org.mitre.oval:def:9628 vdb-entry signature