Description
Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an "alternate web page."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mozilla | 2:1.7.8-1sarge7.1 | DSA-1118 |
| Debian 3.1 | mozilla-firefox | 1.0.4-2sarge9 | DSA-1120 |
| Debian 3.1 | mozilla-thunderbird | 1.0.2-2.sarge1.0.8a | DSA-1134-1 |
Advisories 3
- DSA-1120 mozilla-firefox - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1118 mozilla - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1134-1 mozilla-thunderbird - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21176 third-party-advisory
- ADV-2006-3748 vdb-entry
- 24713 vdb-entry
- 19698 third-party-advisory
- 20060418 Another flaw in Firefox 1.5.0.2: to open files from remote mailing-list
- 20063 third-party-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-39.html
- firefox-viewimage-security-bypass(25925) vdb-entry
- 20060505 Firefox 1.5.0.3 code execution exploit mailing-list
- http://www.networksecurity.fi/advisories/netscape-view-image.html
- 20060602 rPSA-2006-0091-1 firefox thunderbird mailing-list
- 20376 third-party-advisory
- 1016202 vdb-entry
- 18228 vdb-entry
- ADV-2008-0083 vdb-entry
- SSRT061181 vendor-advisory
- DSA-1118 vendor-advisory
- DSA-1120 vendor-advisory
- 19988 third-party-advisory
- http://www.gavinsharp.com/tmp/ImageVuln.html
- DSA-1134 vendor-advisory
- 21324 third-party-advisory
- 21183 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=334341
- 22066 third-party-advisory
- SUSE-SA:2006:035 vendor-advisory
- ADV-2006-2106 vdb-entry
- 20060507 Re: Firefox 1.5.0.3 code execution exploit mailing-list