CVE-2002-1091 Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width.
HighCVSS 7.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla | = 0.9.5 | No fix listed |
| mozilla | = 0.9.6 | No fix listed |
| mozilla | = 0.9.7 | No fix listed |
| mozilla | = 0.9.8 | No fix listed |
| mozilla | = 0.9.9 | No fix listed |
| mozilla | = 1.0 | No fix listed |
| netscape navigator | = 6.2 | No fix listed |
| netscape navigator | = 6.2.1 | No fix listed |
| netscape navigator | = 6.2.2 | No fix listed |
| netscape navigator | = 6.2.3 | No fix listed |
| opera software opera web browser | = 5.12 | No fix listed |
| opera software opera web browser | = 6.0 | No fix listed |
| opera software opera web browser | = 6.0.1 | No fix listed |
References
- bugzilla.mozilla.org
- crash.ihug.co.nz
- 20020906 zero-width gif: exploit PoC for NS6.2.3 (fixed in 7.0) [Was: GIFs mailing-list
- netscape-zero-gif-bo(10058) vdb-entry vendor-advisory
- MDKSA-2002:075 vendor-advisory
- RHSA-2002:192 patch vendor-advisory
- RHSA-2003:046 vendor-advisory
- 5665 exploit patch vdb-entry vendor-advisory