CVE-2005-2265
MediumPublic exploitFirefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.
Published Jul 12, 2005 · Updated Mar 9, 2026
Key Facts
Patch immediately- CVE-2005-2265 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Firefox (Mozilla), Mozilla, mozilla-firefox (debian) and 3 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 68% probability of exploitation in the next 30 days.
- Fixed versions are available, including devhelp 0:0.9.2-2.4.6, Firefox 0:1.0.6-1.4.1, Mozilla 2:1.7.8-1sarge2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS (30-day exploit likelihood)
68%
Higher than 99.3% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2005-2265 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.
Affected Products
44 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | 0.10, 0.10.1, 0.8, 0.9, 0.9.1, 0.9.2, 0.9.3, 0.9-rc | 0:1.0.6-1.4.1 |
| MozillaMozilla | 1.3, 1.4, 1.4.1, 1.4-alpha, 1.5, 1.5.1, 1.5-alpha, 1.5-rc1 | 2:1.7.8-1sarge2 |
| mozilla-firefoxdebian | See advisory | 1.0.4-2sarge2 |
| mozilla-thunderbirddebian | See advisory | 1.0.2-2.sarge1.0.6 |
| devhelpredhat | See advisory | 0:0.9.2-2.4.6 |
Patched Releases
devhelp
0:0.9.2-2.4.6
Firefox
0:1.0.6-1.4.1
Mozilla
2:1.7.8-1sarge2
mozilla-firefox
1.0.4-2sarge2, 1.0.4-2sarge3
mozilla-thunderbird
1.0.2-2.sarge1.0.6
thunderbird
0:1.0.6-1.4.1
Timeline
Publicly disclosed
Jul 12, 2005
Last updated
Mar 9, 2026
References
- advisoryRHSA-2005:586
- advisoryRHSA-2005:587
- advisoryRHSA-2005:601
- patchhttp://www.mozilla.org/security/announce/mfsa2005-50.html
- exploithttps://bugzilla.mozilla.org/show_bug.cgi?id=295854
FAQ
Common Questions.
Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service (access violation and crash), and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string.
Affected: Firefox (Mozilla) versions 0.10, 0.10.1, 0.8, 0.9, 0.9.1, 0.9.2, 0.9.3, 0.9-rc; Mozilla versions 1.3, 1.4, 1.4.1, 1.4-alpha, 1.5, 1.5.1, 1.5-alpha, 1.5-rc1; mozilla-firefox (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including devhelp 0:0.9.2-2.4.6, Firefox 0:1.0.6-1.4.1, Mozilla 2:1.7.8-1sarge2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2005-2265 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo