Vulnerability Name: | CVE-2006-2779 (CCN-26843) |
Assigned: | 2006-06-02 |
Published: | 2006-06-02 |
Updated: | 2018-10-18 |
Summary: | Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) nested <option> tags in a select tag, (2) a DOMNodeRemoved mutation event, (3) "Content-implemented tree views," (4) BoxObjects, (5) the XBL implementation, (6) an iframe that attempts to remove itself, which leads to memory corruption. |
CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)Exploitability Metrics: | Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None | Scope: | Scope (S): Unchanged
| Impact Metrics: | Confidentiality (C): Low Integrity (I): Low Availibility (A): Low |
|
CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)Exploitability Metrics: | Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None | Impact Metrics: | Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete | 7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)Exploitability Metrics: | Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
| Impact Metrics: | Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial |
|
Vulnerability Type: | CWE-94
|
Vulnerability Consequences: | Gain Access |
References: | Source: MITRE Type: CNA CVE-2006-2779
Source: CCN Type: RHSA-2006-0578 seamonkey security update (was mozilla)
Source: CCN Type: RHSA-2006-0594 seamonkey security update (was mozilla)
Source: CCN Type: RHSA-2006-0609 seamonkey security update
Source: REDHAT Type: Vendor Advisory RHSA-2006:0609
Source: CCN Type: RHSA-2006-0610 firefox security update
Source: CCN Type: RHSA-2006-0611 thunderbird security update
Source: CCN Type: SA20376 Firefox Multiple Vulnerabilities
Source: SECUNIA Type: Patch, Vendor Advisory 20376
Source: CCN Type: SA20382 Thunderbird Multiple Vulnerabilities
Source: SECUNIA Type: Patch, Vendor Advisory 20382
Source: SECUNIA Type: Patch, Vendor Advisory 20561
Source: SECUNIA Type: UNKNOWN 20709
Source: SECUNIA Type: Vendor Advisory 21134
Source: SECUNIA Type: Vendor Advisory 21176
Source: SECUNIA Type: Vendor Advisory 21178
Source: SECUNIA Type: Vendor Advisory 21183
Source: SECUNIA Type: Vendor Advisory 21188
Source: SECUNIA Type: Vendor Advisory 21210
Source: SECUNIA Type: Vendor Advisory 21269
Source: SECUNIA Type: Vendor Advisory 21270
Source: SECUNIA Type: Vendor Advisory 21324
Source: SECUNIA Type: Vendor Advisory 21336
Source: SECUNIA Type: Vendor Advisory 21532
Source: SECUNIA Type: Vendor Advisory 21607
Source: SECUNIA Type: Vendor Advisory 21631
Source: SECUNIA Type: Vendor Advisory 21634
Source: SECUNIA Type: Vendor Advisory 21654
Source: SECUNIA Type: UNKNOWN 22065
Source: SECUNIA Type: UNKNOWN 22066
Source: SECUNIA Type: UNKNOWN 27216
Source: CCN Type: SECTRACK ID: 1016202 Mozilla Firefox Bugs Permit Arbitrary Code Execution, Cross-Site Scripting, and HTTP Response Smuggling
Source: SECTRACK Type: Patch 1016202
Source: CCN Type: SECTRACK ID: 1016214 Mozilla Thunderbird Bugs Permit Arbitrary Code Execution, Cross-Site Scripting, and HTTP Response Smuggling
Source: SECTRACK Type: Patch 1016214
Source: CCN Type: Sun Alert ID: 102943 Multiple Memory Corruption Vulnerabilities in Mozilla 1.7 for Solaris 8, 9, and 10
Source: SUNALERT Type: UNKNOWN 102943
Source: SUNALERT Type: UNKNOWN 200387
Source: CCN Type: ASA-2006-146 seamonkey security update (was mozilla) (RHSA-2006-0578)
Source: CCN Type: ASA-2006-151 firefox seamonkey and thunderbird security update (RHSA-2006-0609 RHSA-2006-0610 and RHSA-2006-0611)
Source: CCN Type: ASA-2006-208 seamonkey security update (was mozilla) (RHSA-2006-0594)
Source: CCN Type: ASA-2006-259 HP-UX Firefox Vulnerabilities
Source: CCN Type: ASA-2007-097 HP-UX Running Firefox Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (HPSBUX02153)
Source: CCN Type: ASA-2007-135 HP-UX Running Thunderbird Remote Unauthorized Access or Elevation of Privileges or Denial of Service (HPSBUX02156)
Source: CCN Type: ASA-2007-435 Multiple Memory Corruption Vulnerabilities in Mozilla 1.7 for Solaris 8 9 and 10 (Sun 102943)
Source: DEBIAN Type: UNKNOWN DSA-1118
Source: DEBIAN Type: UNKNOWN DSA-1120
Source: DEBIAN Type: UNKNOWN DSA-1134
Source: DEBIAN Type: UNKNOWN DSA-1159
Source: DEBIAN Type: UNKNOWN DSA-1160
Source: DEBIAN Type: DSA-1118 mozilla -- several vulnerabilities
Source: DEBIAN Type: DSA-1120 mozilla-firefox -- several vulnerabilities
Source: DEBIAN Type: DSA-1134 mozilla-thunderbird -- several vulnerabilities
Source: DEBIAN Type: DSA-1159 mozilla-thunderbird -- several vulnerabilities
Source: DEBIAN Type: DSA-1160 mozilla -- several vulnerabilities
Source: CCN Type: GLSA-200606-12 Mozilla Firefox: Multiple vulnerabilities
Source: GENTOO Type: Patch, Vendor Advisory GLSA-200606-12
Source: CCN Type: GLSA-200606-21 Mozilla Thunderbird: Multiple vulnerabilities
Source: GENTOO Type: UNKNOWN GLSA-200606-21
Source: CCN Type: GLSA-200703-05 Mozilla Suite: Multiple vulnerabilities
Source: CCN Type: US-CERT VU#466673 Mozilla contains multiple memory corruption vulnerabilities
Source: CERT-VN Type: US Government Resource VU#466673
Source: MANDRIVA Type: UNKNOWN MDKSA-2006:143
Source: MANDRIVA Type: UNKNOWN MDKSA-2006:145
Source: MANDRIVA Type: UNKNOWN MDKSA-2006:146
Source: CCN Type: MFSA 2006-32 Fixes for potential memory corruption
Source: CONFIRM Type: UNKNOWN http://www.mozilla.org/security/announce/2006/mfsa2006-32.html
Source: SUSE Type: UNKNOWN SUSE-SA:2006:035
Source: REDHAT Type: Vendor Advisory RHSA-2006:0578
Source: REDHAT Type: Vendor Advisory RHSA-2006:0594
Source: REDHAT Type: Vendor Advisory RHSA-2006:0610
Source: REDHAT Type: Vendor Advisory RHSA-2006:0611
Source: BUGTRAQ Type: UNKNOWN 20060602 rPSA-2006-0091-1 firefox thunderbird
Source: HP Type: UNKNOWN SSRT061236
Source: HP Type: UNKNOWN SSRT061181
Source: BID Type: UNKNOWN 18228
Source: CCN Type: BID-18228 Mozilla Firefox, SeaMonkey, Camino, and Thunderbird Multiple Remote Vulnerabilities
Source: CCN Type: USN-296-1 Firefox vulnerabilities
Source: CCN Type: USN-296-2 Firefox vulnerabilities
Source: CCN Type: USN-297-1 Thunderbird vulnerabilities
Source: CCN Type: USN-297-2 Thunderbird extensions update for recent security update
Source: CCN Type: USN-297-3 Thunderbird vulnerabilities
Source: CCN Type: USN-323-1 Mozilla vulnerabilities
Source: CERT Type: Patch, US Government Resource TA06-153A
Source: VUPEN Type: UNKNOWN ADV-2006-2106
Source: VUPEN Type: UNKNOWN ADV-2006-3748
Source: VUPEN Type: UNKNOWN ADV-2006-3749
Source: VUPEN Type: UNKNOWN ADV-2007-3488
Source: VUPEN Type: UNKNOWN ADV-2008-0083
Source: XF Type: UNKNOWN mozilla-browserengine-memory-corruption(26843)
Source: XF Type: UNKNOWN mozilla-browserengine-memory-corruption(26843)
Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:9762
Source: UBUNTU Type: UNKNOWN USN-296-1
Source: UBUNTU Type: UNKNOWN USN-296-2
Source: UBUNTU Type: UNKNOWN USN-297-1
Source: UBUNTU Type: UNKNOWN USN-297-3
Source: UBUNTU Type: UNKNOWN USN-323-1
Source: SUSE Type: SUSE-SA:2006:035 Mozilla browser security problems
|
Vulnerable Configuration: | Configuration 1: cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:preview_release:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7:-:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0:-:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5:-:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5.2:*:*:*:*:*:*:* Configuration RedHat 1: cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:* Configuration RedHat 2: cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:* Configuration RedHat 3: cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:* Configuration RedHat 4: cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:* Configuration RedHat 5: cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:* Configuration CCN 1: cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.7:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5:-:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7:-:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0:-:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.0.8:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5.1:*:*:*:*:*:*:*OR cpe:/a:mozilla:thunderbird:1.5.2:*:*:*:*:*:*:*AND cpe:/o:sun:solaris:8::x86:*:*:*:*:*OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*OR cpe:/o:sun:solaris:8::sparc:*:*:*:*:*OR cpe:/o:sun:solaris:9::x86:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:*OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:*
Denotes that component is vulnerable |
Oval Definitions |
|
BACK |
mozilla firefox 0.8
mozilla firefox 0.9
mozilla firefox 0.9 rc
mozilla firefox 0.9.1
mozilla firefox 0.9.2
mozilla firefox 0.9.3
mozilla firefox 0.10
mozilla firefox 0.10.1
mozilla firefox 1.0
mozilla firefox 1.0.1
mozilla firefox 1.0.2
mozilla firefox 1.0.3
mozilla firefox 1.0.4
mozilla firefox 1.0.5
mozilla firefox 1.0.6
mozilla firefox 1.0.7
mozilla firefox 1.0.8
mozilla firefox 1.5
mozilla firefox 1.5 beta1
mozilla firefox 1.5 beta2
mozilla firefox 1.5.0.2
mozilla firefox 1.5.1
mozilla firefox 1.5.2
mozilla firefox 1.5.3
mozilla firefox preview_release
mozilla thunderbird 0.6
mozilla thunderbird 0.7
mozilla thunderbird 0.7.1
mozilla thunderbird 0.7.2
mozilla thunderbird 0.7.3
mozilla thunderbird 0.8
mozilla thunderbird 0.9
mozilla thunderbird 1.0
mozilla thunderbird 1.0.1
mozilla thunderbird 1.0.2
mozilla thunderbird 1.0.5
mozilla thunderbird 1.0.6
mozilla thunderbird 1.0.7
mozilla thunderbird 1.0.8
mozilla thunderbird 1.5
mozilla thunderbird 1.5 beta2
mozilla thunderbird 1.5.1
mozilla thunderbird 1.5.2
mozilla firefox 0.8
mozilla firefox 0.9 rc
mozilla firefox 0.9.2
mozilla firefox 0.9.1
mozilla firefox 0.9.3
mozilla firefox 0.10.1
mozilla thunderbird 0.8
mozilla firefox 1.0
mozilla thunderbird 1.0.1
mozilla firefox 1.0.1
mozilla firefox 1.0.2
mozilla firefox 1.0.3
mozilla firefox 1.0.4
mozilla firefox 1.0.6
mozilla firefox 1.5 beta1
mozilla firefox 1.0.7
mozilla thunderbird 1.0.2
mozilla thunderbird 1.0.6
mozilla thunderbird 1.0.7
mozilla firefox 1.5
mozilla thunderbird 1.5
mozilla thunderbird 1.5 beta2
mozilla firefox 1.5.0.2
mozilla firefox 1.0.8
mozilla firefox 0.10
mozilla firefox 0.9
mozilla firefox 1.0.5
mozilla firefox 1.5.1
mozilla firefox 1.5.2
mozilla firefox 1.5.3
mozilla firefox 1.5 beta2
mozilla thunderbird 0.6
mozilla thunderbird 0.7
mozilla thunderbird 0.7.1
mozilla thunderbird 0.7.2
mozilla thunderbird 0.7.3
mozilla thunderbird 0.9
mozilla thunderbird 1.0
mozilla thunderbird 1.0.5
mozilla thunderbird 1.0.8
mozilla thunderbird 1.5.1
mozilla thunderbird 1.5.2
sun solaris 8
gentoo linux *
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 3
redhat enterprise linux 3
redhat enterprise linux 3
sun solaris 8
sun solaris 9
redhat enterprise linux 3
mandrakesoft mandrake linux corporate server 3.0
redhat enterprise linux 4
redhat enterprise linux 4
redhat enterprise linux 4
redhat enterprise linux 4
debian debian linux 3.1
sun solaris 10
sun solaris 10
redhat linux advanced workstation 2.1
mandrakesoft mandrake linux 2006
canonical ubuntu 6.06
suse suse linux 10.1
mandrakesoft mandrake linux 2006
mandrakesoft mandrake linux corporate server 3.0
sun solaris 9