CVE-2005-0230

Firefox 1.0 does not prevent the user from dragging an executable file to the desktop when it has an image/gif content type but has a dangerous extension such as .bat or .exe, which allows remote attackers to bypass the intended restriction and execute arbitrary commands via malformed GIF files that can still be parsed by the Windows batch file parser, aka "firedragging."

• http://marc.info/?l=bugtraq&m=110780995232064&w=2
• http://secunia.com/advisories/19823
• http://www.gentoo.org/security/en/glsa/glsa-200503-10.xmlPatch, Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200503-30.xmlPatch, Vendor Advisory
• http://www.mikx.de/firedragging/Exploit
• http://www.mozilla.org/security/announce/mfsa2005-25.htmlPatch
• http://www.novell.com/linux/security/advisories/2006_04_25.html
• http://www.securityfocus.com/bid/12468
• https://bugzilla.mozilla.org/show_bug.cgi?id=279945Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100033
• http://marc.info/?l=bugtraq&m=110780995232064&w=2
• http://secunia.com/advisories/19823
• http://www.gentoo.org/security/en/glsa/glsa-200503-10.xmlPatch, Vendor Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200503-30.xmlPatch, Vendor Advisory
• http://www.mikx.de/firedragging/Exploit
• http://www.mozilla.org/security/announce/mfsa2005-25.htmlPatch
• http://www.novell.com/linux/security/advisories/2006_04_25.html
• http://www.securityfocus.com/bid/12468
• https://bugzilla.mozilla.org/show_bug.cgi?id=279945Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100033

Published

May 2, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-0224Unknown vulnerability in HP-UX B.11.04 running Virtualvault …
• CVE-2005-0225firehol.sh in FireHOL before 1.224 creates temporary files w…
• CVE-2005-0226Format string vulnerability in the Log_Resolver function in …
• CVE-2005-0227PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows l…
• CVE-2005-0228Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2005-0229CitrusDB 0.3.5 and earlier stores the newfile.txt temporary …
• CVE-2005-0231Firefox 1.0 does not invoke the Javascript Security Manager …
• CVE-2005-0232Firefox 1.0 allows remote attackers to modify Boolean config…
• CVE-2005-0233The International Domain Name (IDN) support in Firefox 1.0, …
• CVE-2005-0234The International Domain Name (IDN) support in Safari 1.2.5 …
• CVE-2005-0235The International Domain Name (IDN) support in Opera 7.54 al…
• CVE-2005-0236The International Domain Name (IDN) support in Omniweb 5 all…