CVE-2004-0905: Conectiva Linux

Medium severity, CVSS 4.6. EPSS: 3% chance of exploitation in the next 30 days.

Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and possibly execute arbitrary code by convincing a user to drag and drop javascript: links to a frame or page in another domain.

Affected products

• Conectiva Linux: version 9.0 only; version 10.0 only
• Mozilla Firefox: version 0.8 only; version 0.9 only; version 0.9.1 only; version 0.9.2 only; version 0.9.3 only
• Mozilla Mozilla: version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.1 only; version 1.2 only; version 1.2.1 only; …
• Netscape Navigator: version 7.0 only; version 7.0.2 only; version 7.1 only; version 7.2 only
• Red Hat Enterprise Linux: version 2.1 only; version 3.0 only
• Red Hat Enterprise Linux Desktop: version 3.0 only
• Red Hat Fedora Core: version core_1.0 only
• Red Hat Linux: version 7.3 only; version 9.0 only
• Red Hat Linux Advanced Workstation: version 2.1 only
• Suse Suse Linux: version 1.0 only; version 8 only; version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only

Published 2004-09-14. Last modified 2026-06-16.