Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade zhCN-linux-mozillafirebirdUpgrade mozillaUpgrade de-linux-netscapeUpgrade zhTW-linux-mozillafirebirdUpgrade linux-mozilla-develUpgrade firefoxUpgrade linux-phoenixUpgrade ja-netscape7Upgrade mozilla-embeddedUpgrade mozilla-gtk2Upgrade linux-mozillaUpgrade netscape7Upgrade thunderbirdUpgrade ru-linux-mozillafirebirdUpgrade pt_BR-netscape7Upgrade mozilla-gtk1Upgrade mozilla-thunderbirdUpgrade fr-linux-netscapeUpgrade phoenixUpgrade de-linux-mozillafirebirdUpgrade mozilla-gtkUpgrade linux-mozillafirebirdUpgrade el-linux-mozillafirebirdUpgrade de-netscape7Upgrade mozilla+ipv6Upgrade linux-netscapeUpgrade mozilla-firebirdUpgrade fr-netscape7Upgrade ja-linux-netscapeUpgrade ja-mozillafirebird-gtk2Upgrade ja-linux-mozillafirebird-gtk1 | Dec 10, 2025 | Sep 30, 2004 |
| Suse | — | Upgrade mozillaUpgrade mozilla-dom-inspectorUpgrade mozilla-calendarUpgrade mozilla-ircUpgrade mozilla-mailUpgrade mozilla-venkman | Feb 17, 2015 | Aug 18, 2004 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub