CVEvulnerability
CVE-2003-0791
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2003-10-07
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed.
Affected configurations
• mozilla mozilla (<= 1.4)
• sco openserver 5.0.7
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
Referenced by CWE · observed example (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://secunia.com/advisories/11103/ URL Repurposed
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:021 Broken Link
- http://www.osvdb.org/8390 Broken Link, Patch, Vendor Advisory
- http://www.securityfocus.com/advisories/6979 Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
- http://www.securityfocus.com/bid/9322 Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=221526 Issue Tracking, Patch, Vendor Advisory
- http://secunia.com/advisories/11103/ URL Repurposed
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:021 Broken Link
- http://www.osvdb.org/8390 Broken Link, Patch, Vendor Advisory
- http://www.securityfocus.com/advisories/6979 Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
- http://www.securityfocus.com/bid/9322 Broken Link, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=221526 Issue Tracking, Patch, Vendor Advisory