Description
Mozilla Firefox 2.0.0.4 and earlier allows remote attackers to read files in the local Firefox installation directory via a resource:// URI.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | iceape | 1.0.13~pre080614i-0etch1 | DSA-1697-1 |
| Debian 4.0 | iceweasel | 2.0.0.19-0etch1 | DSA-1707-1 |
| Debian 4.0 | xulrunner | 1.8.0.15~pre080614i-0etch1 | DSA-1704-1 |
Advisories 3
- DSA-1704-1 xulrunner - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1697-1 iceape - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1707-1 iceweasel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20070604 Unpatched input validation flaw in Firefox 2.0.0.4 mailing-list
- 35918 vdb-entry
- http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004/
- http://larholm.com/2007/05/25/firefox-0day-local-file-reading/
- http://ha.ckers.org/blog/20070516/read-firefox-settings-poc/
- https://bugzilla.mozilla.org/show_bug.cgi?id=367428
- 25481 third-party-advisory