CVE-2005-0255

String handling functions in Mozilla 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2, such as the nsTSubstring_CharT::Replace function, do not properly check the return values of other functions that resize the string, which allows remote attackers to cause a denial of service and possibly execute arbitrary code by forcing an out-of-memory state that causes a reallocation to fail and return a pointer to a fixed address, which leads to heap corruption.

Affected Software

Name	Vendor	Start Version	End Version
Firefox	Mozilla	1.0 (including)	1.0 (including)
Mozilla	Mozilla	1.7.3 (including)	1.7.3 (including)
Thunderbird	Mozilla	0.1 (including)	0.1 (including)
Thunderbird	Mozilla	0.2 (including)	0.2 (including)
Thunderbird	Mozilla	0.3 (including)	0.3 (including)
Thunderbird	Mozilla	0.4 (including)	0.4 (including)
Thunderbird	Mozilla	0.5 (including)	0.5 (including)
Thunderbird	Mozilla	0.6 (including)	0.6 (including)
Thunderbird	Mozilla	0.7 (including)	0.7 (including)
Thunderbird	Mozilla	0.8 (including)	0.8 (including)
Thunderbird	Mozilla	0.9 (including)	0.9 (including)
Thunderbird	Mozilla	1.0 (including)	1.0 (including)
Red Hat Enterprise Linux 4	RedHat	firefox-0:1.0.1-1.4.3	*
Red Hat Enterprise Linux 4	RedHat	thunderbird-0:1.0.2-1.4.1	*
Mozilla	Ubuntu	edgy	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2005-0255
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References