Unscored CVE-2005-2703 EUVD-2005-2704GHSA-g9fw-v33p-xrq5

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest…

Published Sep 23, 2005 · Updated Aug 7, 2024 · Assigned by redhat

Description

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to modify HTTP headers of XML HTTP requests via XMLHttpRequest, and possibly use the client to exploit vulnerabilities in servers or proxies, including HTTP request smuggling and HTTP request splitting.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 3.1	mozilla	1:1.7.8-1sarge3	DSA-866-1
Debian 3.1	mozilla-firefox	1.0.4-2sarge5	DSA-838-1
Debian 3.1	mozilla-thunderbird	1.0.2-2.sarge1.0.7	DSA-868-1
Debian 3.0	mozilla	No fix yet	DSA-866-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 4	devhelp +1	0.9.2-2.4.7	RHSA-2005:789
RHEL 4	firefox +1	1.0.7-1.4.1	RHSA-2005:791, RHSA-2005:785

Advisories 6

RHSA-2005:791 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2005:789 Red Hat Security Advisory: mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2005:785 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
DSA-868-1 mozilla-thunderbird - several Debian Security (DSA / DLA) · Mar 9, 2026
DSA-838-1 mozilla-firefox - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
DSA-866-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026

References

MDKSA-2005:169 vendor-advisory
mozilla-xmlhttprequest-spoofing(22376) vdb-entry
DSA-868 vendor-advisory
ADV-2005-1824 vdb-entry
FLSA-2006:168375 vendor-advisory
oval:org.mitre.oval:def:1089 vdb-entry signature
15495 vdb-entry
1014954 vdb-entry
RHSA-2005:789 vendor-advisory
17026 third-party-advisory
RHSA-2005:791 vendor-advisory
USN-200-1 vendor-advisory
17042 third-party-advisory
DSA-866 vendor-advisory
http://www.mozilla.org/security/announce/mfsa2005-58.html
oval:org.mitre.oval:def:10767 vdb-entry signature
17284 third-party-advisory
17149 third-party-advisory
17263 third-party-advisory
16917 third-party-advisory
DSA-838 vendor-advisory
17014 third-party-advisory
RHSA-2005:785 vendor-advisory
SUSE-SA:2005:058 vendor-advisory
MDKSA-2005:174 vendor-advisory
17090 third-party-advisory
16911 third-party-advisory
16977 third-party-advisory
14923 vdb-entry
MDKSA-2005:170 vendor-advisory