{"id":"CVE-2005-0401","aliases":["EUVD-2005-0402","GHSA-p4xc-fq3x-cx45","RHSA-2005:335","RHSA-2005:336"],"status":"published","title":"FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading...","description":"FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka \"Firescrolling 2.\"","severity":{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03307,"percentile":0.88626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2005-03-24T05:00:00Z","modified":"2026-06-26T10:02:50Z","affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"devhelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"devhelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"devhelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"evolution-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"evolution-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"devhelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"devhelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"devhelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"evolution-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"evolution-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"devhelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"devhelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"devhelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"evolution-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"evolution-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"devhelp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"devhelp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"devhelp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.2-2.4.3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"evolution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"evolution-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"evolution-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.2-14"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-1.4.1"}]}],"bundled":3}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"mozilla"}],"references":[{"url":"http://www.redhat.com/support/errata/RHSA-2005-336.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2005/0296","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://mikx.de/firescrolling2/","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.redhat.com/support/errata/RHSA-2005-335.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9650","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/mfsa2005-32.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/12885","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100026","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2005-384.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Vendor Advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=111168413007891\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/14654","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0401","tags":["advisory"]},{"url":"http://mikx.de/firescrolling2"},{"url":"https://github.com/advisories/GHSA-p4xc-fq3x-cx45"},{"url":"https://access.redhat.com/errata/RHSA-2005:335","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=142508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=144228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=146188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=147397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=150866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=151730","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_335.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2004-1380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-1380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1380","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0141","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617470","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0142","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0142","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617471","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0143","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617472","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0144","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0146","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617475","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0149","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617517","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0399","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0401","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2005:336","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=150877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=151153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=151714","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_336.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-0402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1617521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-0402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-0402","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2005-0401","description":"FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka \"Firescrolling 2.\"","status":"published","published":"2005-03-24T05:00:00Z","modified":"2024-08-07T21:13:54.076Z","updated_at":"2026-11-02T14:33:40.578358Z"}],"euvd":[{"id":"EUVD-2005-0402","description":"FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka \"Firescrolling 2.\"","status":"published","published":"2005-03-24T05:00:00Z","modified":"2024-08-07T21:13:54Z","updated_at":"2026-11-03T01:15:38.73276Z"}],"ghsa":[{"id":"GHSA-p4xc-fq3x-cx45","title":"FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading...","description":"FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka \"Firescrolling 2.\"","status":"published","published":"2022-05-01T01:48:56Z","modified":"2025-04-03T04:11:21Z","updated_at":"2026-11-02T15:00:41.656394Z"}],"nvd":[{"id":"CVE-2005-0401","description":"FireFox 1.0.1 and Mozilla before 1.7.6 do not sufficiently address all attack vectors for loading chrome files and hijacking drag and drop events, which allows remote attackers to execute arbitrary XUL code by tricking a user into dragging a scrollbar, a variant of CVE-2005-0527, aka \"Firescrolling 2.\"","status":"published","published":"2005-05-02T04:00:00Z","modified":"2026-06-16T22:11:02.573Z","cvss":[{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:00:54.933728Z"}],"osv":[{"id":"RHSA-2005:335","title":"Red Hat Security Advisory: mozilla security update","status":"published","published":"2024-09-15T15:21:22Z","modified":"2026-06-26T10:02:49Z","updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHSA-2005:336","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-15T15:21:27Z","modified":"2026-06-26T10:02:50Z","updated_at":"2026-11-02T15:52:59.135214Z"}]}}