CVE-2005-0590
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and...
CVE-2005-0590 is a medium vulnerability (CVSS 5.0) in Mozilla Firefox, published February 28, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 77th percentile. No source names a fixed version.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 1.67%EPSS, 77th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxRed Hat:enterprise_linux:4::as From an advisory covering 16 CVEs | before 0:1.0.1-1.4.3 | 0:1.0.1-1.4.3 |
firefoxRed Hat:enterprise_linux:4::desktop From an advisory covering 16 CVEs | before 0:1.0.1-1.4.3 | 0:1.0.1-1.4.3 |
firefoxRed Hat:enterprise_linux:4::es From an advisory covering 16 CVEs | before 0:1.0.1-1.4.3 | 0:1.0.1-1.4.3 |
firefoxRed Hat:enterprise_linux:4::ws From an advisory covering 16 CVEs | before 0:1.0.1-1.4.3 | 0:1.0.1-1.4.3 |
What each source reports
NVD Score used
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
- Record
CVE-2005-0590- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
- Record
CVE-2005-0590- Updated
- 2026-11-02
EUVDEUVD-2005-0591No score
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
- Record
EUVD-2005-0591- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mq4v-fvj7-qhmjNo score
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and...
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
- Record
GHSA-mq4v-fvj7-qhmj- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/12659
secunia.com/advisories/19823
mozilla.org/security/announce/mfsa2005-17.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100041
bugzilla.mozilla.org/show_bug.cgi?id=268059
Show 89 moreShow less
redhat.com/support/errata/RHSA-2005-176.html
gentoo.org/security/en/glsa/glsa-200503-30.xml
novell.com/linux/security/advisories/2006_04_25.html
nvd.nist.gov/vuln/detail/CVE-2005-0590
github.com/advisories/GHSA-mq4v-fvj7-qhmj
access.redhat.com/errata/RHSA-2005:176
bugzilla.redhat.com/show_bug.cgi?id=142506
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_176.json
cve.org/CVERecord?id=CVE-2004-1156