Unscored CVE-2005-2704 EUVD-2005-2705GHSA-fq97-w52g-3c2q

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an int…

Published Sep 23, 2005 · Updated Aug 7, 2024 · Assigned by redhat

Description

Firefox before 1.0.7 and Mozilla Suite before 1.7.12 allows remote attackers to spoof DOM objects via an XBL control that implements an internal XPCOM interface.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 3.1	mozilla	1:1.7.8-1sarge3	DSA-866-1
Debian 3.1	mozilla-firefox	1.0.4-2sarge5	DSA-838-1
Debian 3.1	mozilla-thunderbird	1.0.2-2.sarge1.0.7	DSA-868-1
Debian 3.0	mozilla	No fix yet	DSA-866-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 4	devhelp +1	0.9.2-2.4.7	RHSA-2005:789
RHEL 4	firefox +1	1.0.7-1.4.1	RHSA-2005:791, RHSA-2005:785

Advisories 6

RHSA-2005:791 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2005:789 Red Hat Security Advisory: mozilla security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
RHSA-2005:785 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
DSA-868-1 mozilla-thunderbird - several Debian Security (DSA / DLA) · Mar 9, 2026
DSA-838-1 mozilla-firefox - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
DSA-866-1 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026

References

MDKSA-2005:169 vendor-advisory
DSA-868 vendor-advisory
ADV-2005-1824 vdb-entry
FLSA-2006:168375 vendor-advisory
15495 vdb-entry
oval:org.mitre.oval:def:9784 vdb-entry signature
1014954 vdb-entry
RHSA-2005:789 vendor-advisory
17026 third-party-advisory
mozilla-thunderbird-xml-object-spoof(22824) vdb-entry
RHSA-2005:791 vendor-advisory
USN-200-1 vendor-advisory
17042 third-party-advisory
DSA-866 vendor-advisory
http://www.mozilla.org/security/announce/mfsa2005-58.html
17284 third-party-advisory
17149 third-party-advisory
17263 third-party-advisory
16917 third-party-advisory
14921 vdb-entry
DSA-838 vendor-advisory
17014 third-party-advisory
RHSA-2005:785 vendor-advisory
SUSE-SA:2005:058 vendor-advisory
MDKSA-2005:174 vendor-advisory
oval:org.mitre.oval:def:1272 vdb-entry signature
17090 third-party-advisory
16911 third-party-advisory
16977 third-party-advisory
MDKSA-2005:170 vendor-advisory