CVE-2005-4134

Mozilla Firefox 0.x/1.x - Large History File Buffer Overflow

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote attackers to cause a denial of service (CPU consumption and delayed application startup) via a web site with a large title, which is recorded in history.dat but not processed efficiently during startup. NOTE: despite initial reports, the Mozilla vendor does not believe that this issue can be used to trigger a crash or buffer overflow in Firefox. Also, it has been independently reported that Netscape 8.1 does not have this issue.

Several security related problems have been discovered in Mozilla Thunderbird. This advisory addresses those issues.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2005-12-09 CVE Reserved
2005-12-09 CVE Published
2013-07-12 First Exploit
2024-08-07 CVE Updated
2025-08-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (57)

URL	Tag	Source
http://marc.info/?l=full-disclosure&m=113404911919629&w=2	Mailing List
http://marc.info/?l=full-disclosure&m=113405896025702&w=2	Mailing List
http://secunia.com/advisories/18700	Third Party Advisory
http://secunia.com/advisories/18704	Third Party Advisory
http://secunia.com/advisories/18705	Third Party Advisory
http://secunia.com/advisories/18706	Third Party Advisory
http://secunia.com/advisories/18708	Third Party Advisory
http://secunia.com/advisories/18709	Third Party Advisory
http://secunia.com/advisories/19230	Third Party Advisory
http://secunia.com/advisories/19746	Third Party Advisory
http://secunia.com/advisories/19759	Third Party Advisory
http://secunia.com/advisories/19852	Third Party Advisory
http://secunia.com/advisories/19862	Third Party Advisory
http://secunia.com/advisories/19863	Third Party Advisory
http://secunia.com/advisories/19902	Third Party Advisory
http://secunia.com/advisories/19941	Third Party Advisory
http://secunia.com/advisories/21033	Third Party Advisory
http://secunia.com/advisories/21622	Third Party Advisory
http://securitytracker.com/id?1015328	Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm	X_refsource_confirm
http://www.mozilla.org/security/announce/mfsa2006-03.html	X_refsource_confirm
http://www.mozilla.org/security/history-title.html	X_refsource_misc
http://www.networksecurity.fi/advisories/netscape-history.html	X_refsource_misc
http://www.osvdb.org/21533	Vdb Entry
http://www.securityfocus.com/bid/15773	Vdb Entry
http://www.securityfocus.com/bid/16476	Vdb Entry
http://www.vupen.com/english/advisories/2005/2805	Vdb Entry
http://www.vupen.com/english/advisories/2006/0413	Vdb Entry
http://www.vupen.com/english/advisories/2006/3391	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11382	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1619	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/26762	2013-07-12

URL	Date	SRC

URL	Date	SRC
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt	2018-10-19
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U	2018-10-19
http://secunia.com/advisories/17934	2018-10-19
http://secunia.com/advisories/17944	2018-10-19
http://secunia.com/advisories/17946	2018-10-19
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1	2018-10-19
http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1	2018-10-19
http://www.debian.org/security/2006/dsa-1044	2018-10-19
http://www.debian.org/security/2006/dsa-1046	2018-10-19
http://www.debian.org/security/2006/dsa-1051	2018-10-19
http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml	2018-10-19
http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml	2018-10-19
http://www.mandriva.com/security/advisories?name=MDKSA-2006:036	2018-10-19
http://www.mandriva.com/security/advisories?name=MDKSA-2006:037	2018-10-19
http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00005.html	2018-10-19
http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00006.html	2018-10-19
http://www.redhat.com/support/errata/RHSA-2006-0199.html	2018-10-19
http://www.redhat.com/support/errata/RHSA-2006-0200.html	2018-10-19
http://www.securityfocus.com/archive/1/425975/100/0/threaded	2018-10-19
http://www.securityfocus.com/archive/1/425978/100/0/threaded	2018-10-19
http://www.securityfocus.com/archive/1/438730/100/0/threaded	2018-10-19
https://usn.ubuntu.com/271-1	2018-10-19
https://usn.ubuntu.com/275-1	2018-10-19
https://access.redhat.com/security/cve/CVE-2005-4134	2006-02-02
https://bugzilla.redhat.com/show_bug.cgi?id=1617852	2006-02-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
K-meleon Project Search vendor "K-meleon Project"		K-meleon Search vendor "K-meleon Project" for product "K-meleon"				<= 0.9 Search vendor "K-meleon Project" for product "K-meleon" and version " <= 0.9"		-		Affected
K-meleon Project Search vendor "K-meleon Project"		K-meleon Search vendor "K-meleon Project" for product "K-meleon"				0.7 Search vendor "K-meleon Project" for product "K-meleon" and version "0.7"		-		Affected
K-meleon Project Search vendor "K-meleon Project"		K-meleon Search vendor "K-meleon Project" for product "K-meleon"				0.7_service_pack_1 Search vendor "K-meleon Project" for product "K-meleon" and version "0.7_service_pack_1"		-		Affected
K-meleon Project Search vendor "K-meleon Project"		K-meleon Search vendor "K-meleon Project" for product "K-meleon"				0.8 Search vendor "K-meleon Project" for product "K-meleon" and version "0.8"		-		Affected
K-meleon Project Search vendor "K-meleon Project"		K-meleon Search vendor "K-meleon Project" for product "K-meleon"				0.8.1 Search vendor "K-meleon Project" for product "K-meleon" and version "0.8.1"		-		Affected
K-meleon Project Search vendor "K-meleon Project"		K-meleon Search vendor "K-meleon Project" for product "K-meleon"				0.8.2 Search vendor "K-meleon Project" for product "K-meleon" and version "0.8.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				<= 1.5 Search vendor "Mozilla" for product "Firefox" and version " <= 1.5"		-		Affected
Mozilla Search vendor "Mozilla"		Mozilla Suite Search vendor "Mozilla" for product "Mozilla Suite"				<= 1.7.12 Search vendor "Mozilla" for product "Mozilla Suite" and version " <= 1.7.12"		-		Affected
Netscape Search vendor "Netscape"		Navigator Search vendor "Netscape" for product "Navigator"				<= 8.0.40 Search vendor "Netscape" for product "Navigator" and version " <= 8.0.40"		-		Affected
Netscape Search vendor "Netscape"		Navigator Search vendor "Netscape" for product "Navigator"				7.1 Search vendor "Netscape" for product "Navigator" and version "7.1"		-		Affected
Netscape Search vendor "Netscape"		Navigator Search vendor "Netscape" for product "Navigator"				7.2 Search vendor "Netscape" for product "Navigator" and version "7.2"		-		Affected