CVE-2003-0791

Published: Oct 7, 2003Modified: Apr 16, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed.

Affected (2)

Products: Mozilla: Mozilla · Sco: Openserver

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Mozilla	Up to 1.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Sco Openserver	Version 5.0.7

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (12)

http://secunia.com/advisories/11103/

Source: cve@mitre.org

URL Repurposed

http://www.mandriva.com/security/advisories?name=MDKSA-2004:021

Source: cve@mitre.org

Broken Link

http://www.osvdb.org/8390

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

http://www.securityfocus.com/advisories/6979

Source: cve@mitre.org

Broken LinkPatchThird Party AdvisoryVDB EntryVendor Advisory

http://www.securityfocus.com/bid/9322

Source: cve@mitre.org

Broken LinkPatchThird Party AdvisoryVDB EntryVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=221526

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

http://secunia.com/advisories/11103/