CVE-2005-1159

The native implementations of InstallTrigger and other functions in Firefox before 1.0.3 and Mozilla Suite before 1.7.7 do not properly verify the types of objects being accessed, which causes the Javascript interpreter to continue execution at the wrong memory address, which may allow attackers to cause a denial of service (application crash) and possibly execute arbitrary code by passing objects of the wrong type.

Published: 2005-05-02 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2005-1159 is rated Moderate Risk (59.1/100): CVSS High severity, with medium exploitation likelihood (EPSS 2.95%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2005-1159

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 3.69% 2.95% -0.74%
2 2025-03-30 11.35% 3.69% -7.66%
3 2025-03-29 — 11.35% —

Full EPSS history (8 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2005-1159

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 2.0 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 10.0 6.4 [email protected]

Weakness enumeration for CVE-2005-1159

OS Trackers for CVE-2005-1159

vendor priority summary link
gentoo normal CVE-2005-1159: 1 GLSA(s) (200504-18), 4 atom(s) (www-client/mozilla, www-client/mozilla-bin, www-client/mozilla-firefox, www-client/mozilla-firefox-bin); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2005-1159
redhat medium — https://access.redhat.com/security/cve/CVE-2005-1159
ubuntu medium CVE-2005-1159 medium priority: Ubuntu including 2 source packages (mozilla, mozilla-thunderbird), 10 status rows across 5 suites (dapper, edgy, feisty, gutsy, upstream): DNE 3, released 3, needs-triage 2, ignored 1, not-affected 1. https://ubuntu.com/security/CVE-2005-1159

Affected software / configurations for CVE-2005-1159

Vendor Product Version Raw CPE
mozilla firefox 0.8 cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
mozilla firefox 0.9 cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
mozilla firefox 0.9 cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
mozilla firefox 0.9.1 cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
mozilla firefox 0.9.2 cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
mozilla firefox 0.9.3 cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
mozilla firefox 0.10 cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
mozilla firefox 0.10.1 cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
mozilla firefox 1.0 cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
mozilla firefox 1.0.1 cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
mozilla firefox 1.0.2 cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
mozilla mozilla 1.3 cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
mozilla mozilla 1.4 cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
mozilla mozilla 1.4 cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
mozilla mozilla 1.4.1 cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
mozilla mozilla 1.5 cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
mozilla mozilla 1.5 cpe:2.3:a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
mozilla mozilla 1.5 cpe:2.3:a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
mozilla mozilla 1.5 cpe:2.3:a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
mozilla mozilla 1.5.1 cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
mozilla mozilla 1.6 cpe:2.3:a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
mozilla mozilla 1.6 cpe:2.3:a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
mozilla mozilla 1.6 cpe:2.3:a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
mozilla mozilla 1.7 cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
mozilla mozilla 1.7 cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
mozilla mozilla 1.7 cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
mozilla mozilla 1.7 cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
mozilla mozilla 1.7 cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
mozilla mozilla 1.7 cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
mozilla mozilla 1.7.1 cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
mozilla mozilla 1.7.2 cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
mozilla mozilla 1.7.3 cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
mozilla mozilla 1.7.5 cpe:2.3:a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
mozilla mozilla 1.7.6 cpe:2.3:a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*

References for CVE-2005-1159

URL Tags
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt
http://secunia.com/advisories/14938 Patch Vendor Advisory
http://secunia.com/advisories/14992 Patch Vendor Advisory
http://secunia.com/advisories/19823
http://securitytracker.com/id?1013742 Patch
http://securitytracker.com/id?1013743 Patch
http://www.gentoo.org/security/en/glsa/glsa-200504-18.xml Patch Vendor Advisory
http://www.mozilla.org/security/announce/mfsa2005-40.html Vendor Advisory
http://www.novell.com/linux/security/advisories/2006_04_25.html
http://www.redhat.com/support/errata/RHSA-2005-383.html Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-384.html
http://www.redhat.com/support/errata/RHSA-2005-386.html Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-601.html
http://www.securityfocus.com/bid/13232 Patch
http://www.securityfocus.com/bid/15495
https://bugzilla.mozilla.org/show_bug.cgi?id=290162 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/20123
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100018
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10629
cvelogic Threat Intelligence