CVE-2005-0149

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/19823
http://www.mozilla.org/security/announce/mfsa2005-11.htmlPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2006_04_25.html
http://www.redhat.com/support/errata/RHSA-2005-094.htmlPatch, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-323.htmlPatch, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-335.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/12407
https://bugzilla.mozilla.org/show_bug.cgi?id=268107Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19172
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100047
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11407
http://secunia.com/advisories/19823
http://www.mozilla.org/security/announce/mfsa2005-11.htmlPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2006_04_25.html
http://www.redhat.com/support/errata/RHSA-2005-094.htmlPatch, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-323.htmlPatch, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-335.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/12407
https://bugzilla.mozilla.org/show_bug.cgi?id=268107Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19172
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100047
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11407

Timeline

Published: Feb 15, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-01505.0Firefox before 1.0 allows the user to store a (1) javascript: or (2) data: URLs as a Livefeed bookmark, then executes it in the security con CVE-2005-01517.5Unknown vulnerability in the installation of Adobe License Management Service, as used in Adobe Photoshop CS, Adobe Creative Suite 1.0, and CVE-2005-01527.5PHP remote file inclusion vulnerability in Squirrelmail 1.2.6 allows remote attackers to execute arbitrary code via "URL manipulation."CVE-2005-01554.6The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PE CVE-2005-01562.1Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitr CVE-2005-01577.5The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that speci CVE-2005-01587.5Format string vulnerability in bidwatcher before 1.3.17 allows remote malicious web servers from eBay, or a spoofed eBay server, to cause a CVE-2005-01594.6The tpkg-* scripts in the toolchain-source 3.0.4 package on Debian GNU/Linux 3.0 allow local users to overwrite arbitrary files via a symlin CVE-2005-01605.1Multiple buffer overflows in unace 1.2b allow attackers to execute arbitrary code via (1) 2 overflows in ACE archives, (2) a long command li CVE-2005-01612.1Multiple directory traversal vulnerabilities in unace 1.2b allow attackers to overwrite arbitrary files via an ACE archive containing (1) ..CVE-2005-01627.2Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x CVE-2005-01737.5squid_ldap_auth in Squid 2.5 and earlier allows remote authenticated users to bypass username-based Access Control Lists (ACLs) via a userna