CVE-2004-0904: Conectiva Linux

High severity, CVSS 10.0. EPSS: 8% chance of exploitation in the next 30 days.

Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows.

Affected products

• Conectiva Linux: version 9.0 only; version 10.0 only
• Mozilla Firefox: version 0.8 only; version 0.9 only; version 0.9.1 only; version 0.9.2 only; version 0.9.3 only
• Mozilla Mozilla: version 1.7 only; version 1.7.1 only; version 1.7.2 only
• Mozilla Thunderbird: version 0.6 only; version 0.7 only; version 0.7.1 only; version 0.7.2 only; version 0.7.3 only
• Netscape Navigator: version 7.0 only; version 7.0.2 only; version 7.1 only; version 7.2 only
• Red Hat Enterprise Linux: version 2.1 only; version 3.0 only
• Red Hat Enterprise Linux Desktop: version 3.0 only
• Red Hat Fedora Core: version core_1.0 only
• Red Hat Linux: version 7.3 only; version 9.0 only
• Red Hat Linux Advanced Workstation: version 2.1 only

Published 2004-12-31. Last modified 2026-06-16.