CVE-2004-0906
Summary
| CVE | CVE-2004-0906 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2004-12-31 05:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code. |
Risk And Classification
Primary CVSS: v2.0 4.6 from [email protected]
AV:L/AC:L/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:L/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mozilla | Mozilla | 0.8 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.2 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.2.1 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.3 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.35 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.4 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.4.1 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.48 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.5 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.6 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.7 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.8 | All | All | All |
| Application | Mozilla | Mozilla | 0.9.9 | All | All | All |
| Application | Mozilla | Mozilla | 1.0 | All | All | All |
| Application | Mozilla | Mozilla | 1.0 | rc1 | All | All |
| Application | Mozilla | Mozilla | 1.0 | rc2 | All | All |
| Application | Mozilla | Mozilla | 1.0.1 | All | All | All |
| Application | Mozilla | Mozilla | 1.0.2 | All | All | All |
| Application | Mozilla | Mozilla | 1.1 | All | All | All |
| Application | Mozilla | Mozilla | 1.1 | alpha | All | All |
| Application | Mozilla | Mozilla | 1.1 | beta | All | All |
| Application | Mozilla | Mozilla | 1.2 | All | All | All |
| Application | Mozilla | Mozilla | 1.2 | alpha | All | All |
| Application | Mozilla | Mozilla | 1.2 | beta | All | All |
| Application | Mozilla | Mozilla | 1.2.1 | All | All | All |
| Application | Mozilla | Mozilla | 1.3 | All | All | All |
| Application | Mozilla | Mozilla | 1.3.1 | All | All | All |
| Application | Mozilla | Mozilla | 1.4 | All | All | All |
| Application | Mozilla | Mozilla | 1.4 | alpha | All | All |
| Application | Mozilla | Mozilla | 1.4 | beta | All | All |
| Application | Mozilla | Mozilla | 1.4.1 | All | All | All |
| Application | Mozilla | Mozilla | 1.4.2 | All | All | All |
| Application | Mozilla | Mozilla | 1.4.4 | All | All | All |
| Application | Mozilla | Mozilla | 1.5 | All | All | All |
| Application | Mozilla | Mozilla | 1.5.1 | All | All | All |
| Application | Mozilla | Mozilla | 1.6 | All | All | All |
| Application | Mozilla | Mozilla | 1.7 | All | All | All |
| Application | Mozilla | Mozilla | 1.7 | alpha | All | All |
| Application | Mozilla | Mozilla | 1.7 | beta | All | All |
| Application | Mozilla | Mozilla | 1.7 | rc1 | All | All |
| Application | Mozilla | Mozilla | 1.7 | rc2 | All | All |
| Application | Mozilla | Mozilla | 1.7 | rc3 | All | All |
| Application | Mozilla | Mozilla | 1.7.1 | All | All | All |
| Application | Mozilla | Mozilla | 1.7.2 | All | All | All |
| Application | Mozilla | Thunderbird | 0.1 | All | All | All |
| Application | Mozilla | Thunderbird | 0.2 | All | All | All |
| Application | Mozilla | Thunderbird | 0.3 | All | All | All |
| Application | Mozilla | Thunderbird | 0.4 | All | All | All |
| Application | Mozilla | Thunderbird | 0.5 | All | All | All |
| Application | Mozilla | Thunderbird | 0.6 | All | All | All |
| Application | Mozilla | Thunderbird | 0.7 | All | All | All |
| Application | Mozilla | Thunderbird | 0.7.1 | All | All | All |
| Application | Mozilla | Thunderbird | 0.7.2 | All | All | All |
| Application | Mozilla | Thunderbird | 0.7.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | Vendor Advisory |
| Mozilla Security Advisory | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | |
| 231083 – wrong file permissions after installation | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | Patch |
| Gentoo Linux Documentation -- Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| 235781 – XPInstall ignores user's umask when installing files | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | Patch |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| US-CERT Vulnerability Note VU#653160 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | Third Party Advisory, US Government Resource |
| Secunia - Advisories - Mozilla Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.