Read the docs
TI-2005-00929 Aliases CVE-2005-0989GHSA-fm33-hrc3-jr7v

The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6…

Priority LOW 35Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The find_replen function in jsstr.c in the Javascript engine for Mozilla Suite 1.7.6, Firefox 1.0.1 and 1.0.2, and Netscape 7.2 allows remote attackers to read portions of heap memory in a Javascript string via the lambda replace method.

Why it matters now

EPSS 0.10036 95th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableMozilla
cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableMozilla
cpe:2.3:a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableMozilla
cpe:2.3:a:netscape:navigator:7.2:*:*:*:*:*:*:*7.2VulnerableNetscape
  • cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Mozilla
  • cpe:2.3:a:netscape:navigator:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Netscape

Remediation

Red Hat 3 advisories

  • RHSA-2005:601 Released 2005-07-21 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AS version 4 thunderbird-1.0.6-1.4.1, thunderbird-1.0.6-1.4.1.i386, thunderbird-1.0.6-1.4.1.ia64 +1
    • Red Hat Enterprise Linux Desktop version 4 thunderbird-1.0.6-1.4.1, thunderbird-1.0.6-1.4.1.i386
    • Red Hat Enterprise Linux ES version 4 thunderbird-1.0.6-1.4.1, thunderbird-1.0.6-1.4.1.i386, thunderbird-1.0.6-1.4.1.ia64
    • Red Hat Enterprise Linux WS version 4 thunderbird-1.0.6-1.4.1, thunderbird-1.0.6-1.4.1.i386, thunderbird-1.0.6-1.4.1.ia64
  • RHSA-2005:386 Released 2005-04-26 · Red Hat rating Important
    Mozilla security update
    • Red Hat Enterprise Linux AS version 4 devhelp-0.9.2-2.4.4, devhelp-0.9.2-2.4.4.i386, devhelp-0.9.2-2.4.4.ppc +3
    • Red Hat Enterprise Linux Desktop version 4 devhelp-0.9.2-2.4.4, devhelp-0.9.2-2.4.4.i386, devhelp-devel-0.9.2-2.4.4 +1
    • Red Hat Enterprise Linux ES version 4 devhelp-0.9.2-2.4.4, devhelp-0.9.2-2.4.4.i386, devhelp-devel-0.9.2-2.4.4 +1
    • Red Hat Enterprise Linux WS version 4 devhelp-0.9.2-2.4.4, devhelp-0.9.2-2.4.4.i386, devhelp-devel-0.9.2-2.4.4 +1
  • RHSA-2005:383 Released 2005-04-21 · Red Hat rating Important
    firefox security update
    • Red Hat Enterprise Linux AS version 4 firefox-1.0.3-1.4.1, firefox-1.0.3-1.4.1.i386, firefox-1.0.3-1.4.1.ia64 +1
    • Red Hat Enterprise Linux Desktop version 4 firefox-1.0.3-1.4.1, firefox-1.0.3-1.4.1.i386
    • Red Hat Enterprise Linux ES version 4 firefox-1.0.3-1.4.1, firefox-1.0.3-1.4.1.i386, firefox-1.0.3-1.4.1.ia64
    • Red Hat Enterprise Linux WS version 4 firefox-1.0.3-1.4.1, firefox-1.0.3-1.4.1.i386, firefox-1.0.3-1.4.1.ia64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS version 4Fixed RHSA-2005:383, RHSA-2005:386, RHSA-2005:601
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2005:383, RHSA-2005:386, RHSA-2005:601
Red Hat Enterprise Linux ES version 4Fixed RHSA-2005:383, RHSA-2005:386, RHSA-2005:601
Red Hat Enterprise Linux WS version 4Fixed RHSA-2005:383, RHSA-2005:386, RHSA-2005:601

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-0989
  2. 2026-10-03 Alias added: GHSA-fm33-hrc3-jr7v

References

Patch 3

Advisory 4

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences