CVE-2004-0906
Description
The XPInstall installer in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure permissions for certain installed files within xpi packages, which could allow local users to overwrite arbitrary files or execute arbitrary code.
Risk Information
Base Score
7.1
MODERATE
Vector
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
0.144
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities affected in Mozilla Thunderbird 0.7.3 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.1 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.2 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.3 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.4 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.5 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.6 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.7 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.7.1 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.7.2 | Windows |
| Multiple Vulnerabilities are affected in Mozilla Thunderbird 0.7.3 | Windows |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-315938 | Mozilla Thunderbird (68.12.0) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234