Unrated severityNVD Advisory· Published Aug 6, 2004· Updated Apr 16, 2026

CVE-2004-0648

Description

Mozilla (Suite) before 1.7.1, Firefox before 0.9.2, and Thunderbird before 0.7.2 allow remote attackers to launch arbitrary programs via a URI referencing the shell: protocol.

Affected products

Mozilla Corporation/Firefox
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Range: <=0.9.2
Mozilla Corporation/Mozilla
cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*
Range: <=1.7.1
Mozilla Corporation/Thunderbird
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Range: <=0.7.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.kb.cert.org/vuls/id/927014nvdThird Party AdvisoryUS Government Resource
lists.grok.org.uk/pipermail/full-disclosure/2004-July/023573.htmlnvd
marc.infonvd
secunia.com/advisories/12027nvd
www.ciac.org/ciac/bulletins/o-175.shtmlnvd
www.mozilla.org/projects/security/known-vulnerabilities.htmlnvd
www.mozilla.org/security/shell.htmlnvd
exchange.xforce.ibmcloud.com/vulnerabilities/16655nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.020
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000