Skip to content
OpenAdvisories
Unscored CVE-2005-2260 EUVD-2005-2261GHSA-wm6x-mrp3-f56m

The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between …

Published Jul 13, 2005 · Updated Aug 7, 2024 · Assigned by redhat

Description

The browser user interface in Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 does not properly distinguish between user-generated events and untrusted synthetic events, which makes it easier for remote attackers to perform dangerous actions that normally could only be performed manually by the user.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 4.0 mozilla 2:1.7.8-1sarge2 DTSA-14-1
Debian 4.0 mozilla-firefox 1.0.4-2sarge3 DTSA-8-2
Debian 3.1 mozilla 2:1.7.8-1sarge2 DSA-810-1
Debian 3.1 mozilla-firefox 1.0.4-2sarge2 DSA-779-2, DSA-779-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 4 devhelp +1 0.9.2-2.4.6 RHSA-2005:587
RHEL 4 firefox 1.0.6-1.4.1 RHSA-2005:586

Advisories 7

References