VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2004· Updated Apr 16, 2026

CVE-2004-0907

CVE-2004-0907

Description

The Linux install .tar.gz archives for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8, create certain files with insecure permissions, which could allow local users to overwrite those files and execute arbitrary code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Members only

The AI Insight narrative is available to signed-in members. Sign in or create a free account to read it.

Affected products

56
  • Mozilla Corporation/Mozilla45 versions
    cpe:2.3:a:mozilla:mozilla:0.8:*:*:*:*:*:*:*+ 44 more
    • cpe:2.3:a:mozilla:mozilla:0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.35:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.48:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:0.9.9:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.1:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.1:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.2:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.4:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
    • (no CPE)range: < 1.7.3
  • Mozilla Corporation/Thunderbird10 versions
    cpe:2.3:a:mozilla:thunderbird:0.1:*:*:*:*:*:*:*+ 9 more
    • cpe:2.3:a:mozilla:thunderbird:0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*
    • (no CPE)range: < 0.8
  • Mozilla Corporation/Firefoxllm-fuzzy
    Range: < Preview Release

Patches

Members only

Discovered fix commits and diffs is available to signed-in members. Sign in or create a free account to read it.

Vulnerability mechanics

Root cause

"The Linux install .tar.gz archives were built with world-writable permissions and non-root ownership, allowing any local user to overwrite installed files."

Attack vector

A local attacker on a multi-user system can exploit the world-writable permissions (e.g., -rwxrwxrwx on executables, -rw-rw-rw- on data files) to overwrite any file within the Mozilla installation directory. Because the files are owned by a non-root user (UID 500) and are world-writable, the attacker can replace a binary or library with a malicious version. When a legitimate user or system process subsequently executes the trojaned binary, the attacker's code runs with the victim's privileges, leading to arbitrary code execution [ref_id=1].

Affected code

The bug report identifies that the Linux install .tar.gz archives for Mozilla Firefox (before Preview Release), Mozilla (before 1.7.3), and Thunderbird (before 0.8) were packaged with world-writable permissions on files and directories, and with non-root ownership (UID/GID 500). The fix was applied to the packaging scripts (deliver.pl) and the Makefile section that builds the tar archive [ref_id=1].

What the fix does

The fix, checked into the trunk on 2004-08-16 and subsequently into the MOZILLA_1_7_BRANCH and AVIARY branches, modified the packaging scripts (deliver.pl) and the tar-archive build process to strip world-writable permissions (go-w) and to set proper ownership (--owner=0 --group=0) when creating the tarball [ref_id=1]. This ensures that when the archive is extracted, files are not world-writable and are owned by root, preventing local users from tampering with the installation.

Preconditions

  • authThe attacker must have local access to the system where the vulnerable Mozilla package was installed.
  • configThe vulnerable tar.gz archive must have been extracted with permissions preserved (e.g., using tar -p or as root), resulting in world-writable files.

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.