CVE-2005-0590

The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real...

CVE-2005-0588

Firefox before 1.0.1 and Mozilla before 1.7.6 does not restrict xsl:include and xsl:import tags in XSLT stylesheets to the current domain, which allows remote attackers to determine the existence of files on the local system...

CVE-2005-0585

CVE-2005-0585 affects Firefox <1.0.1 and Mozilla

CVE-2005-0624

reportbug before 2.62 creates the .reportbugrc configuration file with world-readable permissions, which allows local users to obtain email smarthost passwords...

CVE-2005-0587

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote malicious web sites to overwrite arbitrary files by tricking the user into downloading a .LNK link file twice, which overwrites the file that was referenced in the first .LNK file...

CVE-2005-0587

CVE-2005-0587 : Firefox versions before 1.0.1 and Mozilla before 1.7.6 are affected. A remote attacker can trick a user into downloading a .LNK file twice, causing arbitrary files referenced by the first link to be overwritten. This stems from how the .LNK files are processed during download. Aff...

CVE-2005-0940

CVE-2005-0940 is a placeholder entry that references CVE-2005-0490 and has been removed from active use. The connected documents provide concrete details for CVE-2005-0490 (CAN-2005-0490), a multi‑stack buffer overflow affecting curl/curl-based components, with remote code execution potential whe...

CVE-2005-0592

Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service crash or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length value...

CVE-2005-0590

CVE-2005-0590 affects Firefox <1.0.1, Thunderbird <1.0.1, and Mozilla

CVE-2005-0588

CVE-2005-0588 affects Firefox <=1.0.0.1 and Mozilla

CVE-2005-0608

Heap-based buffer overflow in server.cpp for WebMod 0.47 allows remote attackers to cause a denial of service crash and execute arbitrary code via a POST request with a Content-Length that is less than the amount of data that is actually sent...

CVE-2005-0584

CVE-2005-0584 affects Firefox before 1.0.1 and Mozilla before 1.7.6: when the HTTP Authentication dialog is shown, focus is not moved to the prompting tab, enabling possible spoofing or phishing. The provided documents confirm the vulnerability and the affected products/versions. Remediation guid...

CVE-2005-0205

CVE-2005-0205 affects KPPP 2.1.2 and earlier within KDE 3.1.5 and earlier. The issue is a local privilege problem where a setuid-root kppp can fail to close a privileged domain-socket file descriptor when wrappers are not used, enabling a local attacker to read/write /etc/hosts and /etc/resolv.co...

CVE-2005-0208

The HTML parsing functions in Gaim before 1.1.4 allow remote attackers to cause a denial of service application crash via malformed HTML that causes "an invalid memory access," a different vulnerability than CVE-2005-0473...

CVE-2005-0593

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via 1 a web site that does not finish loading, which shows the lock of the previous site, 2 a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake ...

CVE-2005-0255

CVE-2005-0255 affects Mozilla Suite 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2. The flaw is in string handling (nsTSubstring_CharT::Replace) where return values of functions that resize strings are not properly checked, which can lead to a reallocation failure and a pointer to a fixed addre...

CVE-2005-0624

reportbug before 2.62 creates the .reportbugrc configuration file with world-readable permissions, which allows local users to obtain email smarthost passwords...

CVE-2005-0565

The Announce module in phpWebSite 0.10.0 and earlier allows remote attackers to execute arbitrary PHP code by setting the Image field to reference a PHP file whose name contains a .gif.php extension...

CVE-2005-0573

CVE-2005-0573 (Gaim 1.1.3 on Windows) is a remote-denial-of-service issue where a file transfer containing a filename with parentheses ("(" or ")") crashes the client. The vulnerability is documented in CVE/NVD with a base score of 5.0 (Medium) and a network attack vector with low complexity; no ...

CVE-2005-0580

CVE-2005-0580 affects cmd5checkpw, where the setuid program does not drop privileges before invoking execvp, enabling local users to read the /etc/poppasswd file. Connected sources (Gentoo GLSA 200502-30, Red Hat advisory, NVD/CVE entry, OpenVAS plugin) corroborate that the root cause is improper...