| Vulnerability Name: | CVE-2006-0299 (CCN-24437) | ||||||||
| Assigned: | 2006-02-01 | ||||||||
| Published: | 2006-02-01 | ||||||||
| Updated: | 2018-10-19 | ||||||||
| Summary: | The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes the internal "AnyName" object to external interfaces, which allows multiple cooperating domains to exchange information in violation of the same origin restrictions. | ||||||||
| CVSS v3 Severity: | 4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N) 4.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2006-0299 Source: CCN Type: SA18700 Firefox Multiple Vulnerabilities Source: SECUNIA Type: UNKNOWN 18700 Source: CCN Type: SA18704 Thunderbird Multiple Vulnerabilities Source: SECUNIA Type: UNKNOWN 18704 Source: SECUNIA Type: UNKNOWN 22065 Source: CCN Type: SECTRACK ID: 1015570 Mozilla Firefox Multiple Vulnerabilities May Let Remote Users Execute Arbitrary Code Source: SECTRACK Type: UNKNOWN 1015570 Source: CCN Type: ASA-2007-135 HP-UX Running Thunderbird Remote Unauthorized Access or Elevation of Privileges or Denial of Service (HPSBUX02156) Source: CCN Type: Mozilla Web site Mozilla Products Source: CONFIRM Type: UNKNOWN http://www.mozilla.org/security/announce/2006/mfsa2006-08.html Source: CCN Type: MFSA 2006-08 "AnyName" entrainment and access control hazard Source: CCN Type: OSVDB ID: 22899 Mozilla Multiple Products E4X AnyName Object Same-origin Restriction Bypass Source: HP Type: UNKNOWN SSRT061236 Source: BID Type: UNKNOWN 16476 Source: CCN Type: BID-16476 Multiple Mozilla Products Memory Corruption/Code Injection/Access Restriction Bypass Vulnerabilities Source: VUPEN Type: UNKNOWN ADV-2006-0413 Source: VUPEN Type: UNKNOWN ADV-2006-3749 Source: CONFIRM Type: UNKNOWN https://bugzilla.mozilla.org/show_bug.cgi?id=322312 Source: XF Type: UNKNOWN mozilla-e4x-security-bypass(24437) Source: XF Type: UNKNOWN mozilla-e4x-security-bypass(24437) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:1625 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||