Vulnerability Name:
CVE-2002-1308 (CCN-10636)
Assigned:
2002-11-14
Published:
2002-11-14
Updated:
2017-10-10
Summary:
Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression.
CVSS v3 Severity:
7.3 High
(CCN CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
)
Exploitability Metrics:
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope:
Scope (S):
Unchanged
Impact Metrics:
Confidentiality (C):
Low
Integrity (I):
Low
Availibility (A):
Low
CVSS v2 Severity:
7.5 High
(CVSS v2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Authentication (Au):
None
Impact Metrics:
Confidentiality (C):
Partial
Integrity (I):
Partial
Availibility (A):
Partial
7.5 High
(CCN CVSS v2 Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
)
Exploitability Metrics:
Access Vector (AV):
Network
Access Complexity (AC):
Low
Athentication (Au):
None
Impact Metrics:
Confidentiality (C):
Partial
Integrity (I):
Partial
Availibility (A):
Partial
Vulnerability Type:
CWE-Other
Vulnerability Consequences:
Gain Access
References:
Source: CCN
Type: SGI Security Advisory 20031003-01-U
SGI Advanced Linux Environment security update #4
Source: MISC
Type: UNKNOWN
http://bugzilla.mozilla.org/show_bug.cgi?id=157646
Source: MITRE
Type: CNA
CVE-2002-1308
Source: BUGTRAQ
Type: UNKNOWN
20021114 Netscape/Mozilla: Exploitable heap corruption via jar: URI handler.
Source: CCN
Type: BugTraq Mailing List, 2002-11-14 15:56:13
Netscape/Mozilla: Exploitable heap corruption via jar: URI handler.
Source: CCN
Type: RHSA-2003-162
Updated Mozilla packages fix security vulnerability.
Source: CCN
Type: RHSA-2003-163
mozilla security update
Source: CCN
Type: CIAC Information Bulletin N-121
Red Hat Updated Mozilla Packages Fix Security Vulnerability
Source: REDHAT
Type: UNKNOWN
RHSA-2003:162
Source: REDHAT
Type: UNKNOWN
RHSA-2003:163
Source: BID
Type: UNKNOWN
6185
Source: CCN
Type: BID-6185
Netscape/Mozilla JAR Remote Heap Corruption Vulnerability
Source: XF
Type: UNKNOWN
mozilla-netscape-jar-bo(10636)
Source: XF
Type: UNKNOWN
mozilla-netscape-jar-bo(10636)
Vulnerable Configuration:
Configuration 1
:
cpe:/a:mozilla:mozilla:0.9.6:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:0.9.7:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:0.9.8:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:0.9.9:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.0:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.0.1:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.1:*:*:*:*:*:*:*
OR
cpe:/a:netscape:navigator:6.2:*:*:*:*:*:*:*
OR
cpe:/a:netscape:navigator:6.2.1:*:*:*:*:*:*:*
OR
cpe:/a:netscape:navigator:6.2.2:*:*:*:*:*:*:*
OR
cpe:/a:netscape:navigator:6.2.3:*:*:*:*:*:*:*
OR
cpe:/a:netscape:navigator:7.0:*:*:*:*:*:*:*
Configuration CCN 1
:
cpe:/a:netscape:navigator:*:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:0.9.6:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:0.9.9:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.0:rc1:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.0:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.0.1:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.1:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:0.9.7:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:0.9.8:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.0.2:*:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.1:alpha:*:*:*:*:*:*
OR
cpe:/a:mozilla:mozilla:1.1:beta:*:*:*:*:*:*
AND
cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
OR
cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
OR
cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
OR
cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
OR
cpe:/o:redhat:linux:8.0:*:*:*:*:*:*:*
OR
cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
OR
cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
OR
cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
OR
cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:*
OR
cpe:/o:sgi:irix:2.3.1:*:*:*:*:*:*:*
OR
cpe:/o:redhat:linux_advanced_workstation:2.1:*:itanium:*:*:*:*:*
Denotes that component is vulnerable
BACK
mozilla
mozilla 0.9.6
mozilla
mozilla 0.9.7
mozilla
mozilla 0.9.8
mozilla
mozilla 0.9.9
mozilla
mozilla 1.0
mozilla
mozilla 1.0.1
mozilla
mozilla 1.1
netscape
navigator 6.2
netscape
navigator 6.2.1
netscape
navigator 6.2.2
netscape
navigator 6.2.3
netscape
navigator 7.0
netscape
navigator *
mozilla
mozilla 0.9.6
mozilla
mozilla 0.9.9
mozilla
mozilla 1.0 rc1
mozilla
mozilla 1.0
mozilla
mozilla 1.0.1
mozilla
mozilla 1.1
mozilla
mozilla 0.9.7
mozilla
mozilla 0.9.8
mozilla
mozilla 1.0.2
mozilla
mozilla 1.1 alpha
mozilla
mozilla 1.1 beta
redhat
linux 7
redhat
linux 7.1
redhat
linux 7.2
redhat
linux 7.3
redhat
linux 8.0
redhat
enterprise linux 2.1
redhat
enterprise linux 2.1
redhat
enterprise linux 2.1
redhat
enterprise linux 2.1
sgi
irix 2.3.1
redhat
linux advanced workstation 2.1