Vulnerability Name:

CVE-2006-3802 (CCN-27983)

Assigned:2006-07-26
Published:2006-07-26
Updated:2018-10-17
Summary:Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
CVSS v3 Severity:4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: SGI
Type: UNKNOWN
20060703-01-P

Source: MITRE
Type: CNA
CVE-2006-3802

Source: CCN
Type: RHSA-2006-0594
seamonkey security update (was mozilla)

Source: CCN
Type: RHSA-2006-0608
seamonkey security update

Source: CCN
Type: RHSA-2006-0609
seamonkey security update

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0609

Source: CCN
Type: RHSA-2006-0610
firefox security update

Source: CCN
Type: RHSA-2006-0611
thunderbird security update

Source: CCN
Type: SA19873
Mozilla Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
19873

Source: SECUNIA
Type: Patch, Vendor Advisory
21216

Source: CCN
Type: SA21228
Mozilla Thunderbird Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
21228

Source: CCN
Type: SA21229
Mozilla SeaMonkey Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
21229

Source: SECUNIA
Type: UNKNOWN
21243

Source: SECUNIA
Type: UNKNOWN
21246

Source: SECUNIA
Type: UNKNOWN
21250

Source: SECUNIA
Type: UNKNOWN
21262

Source: SECUNIA
Type: UNKNOWN
21269

Source: SECUNIA
Type: UNKNOWN
21270

Source: SECUNIA
Type: UNKNOWN
21275

Source: SECUNIA
Type: UNKNOWN
21336

Source: SECUNIA
Type: UNKNOWN
21343

Source: SECUNIA
Type: UNKNOWN
21358

Source: SECUNIA
Type: UNKNOWN
21361

Source: SECUNIA
Type: UNKNOWN
21529

Source: SECUNIA
Type: UNKNOWN
21532

Source: SECUNIA
Type: UNKNOWN
21607

Source: SECUNIA
Type: UNKNOWN
21631

Source: SECUNIA
Type: UNKNOWN
22055

Source: SECUNIA
Type: UNKNOWN
22065

Source: SECUNIA
Type: UNKNOWN
22066

Source: SECUNIA
Type: UNKNOWN
22210

Source: GENTOO
Type: UNKNOWN
GLSA-200608-02

Source: GENTOO
Type: UNKNOWN
GLSA-200608-04

Source: CCN
Type: SECTRACK ID: 1016586
Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016586

Source: CCN
Type: SECTRACK ID: 1016587
Mozilla Seamonkey Multiple Bugs Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016587

Source: CCN
Type: SECTRACK ID: 1016588
Mozilla Thunderbird Multiple Bugs Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016588

Source: CCN
Type: ASA-2006-149
seamonkey security update (RHSA-2006-0608)

Source: CCN
Type: ASA-2006-151
firefox seamonkey and thunderbird security update (RHSA-2006-0609 RHSA-2006-0610 and RHSA-2006-0611)

Source: CCN
Type: ASA-2006-208
seamonkey security update (was mozilla) (RHSA-2006-0594)

Source: CCN
Type: ASA-2006-259
HP-UX Firefox Vulnerabilities

Source: CCN
Type: ASA-2007-097
HP-UX Running Firefox Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (HPSBUX02153)

Source: CCN
Type: ASA-2007-135
HP-UX Running Thunderbird Remote Unauthorized Access or Elevation of Privileges or Denial of Service (HPSBUX02156)

Source: CCN
Type: GLSA-200507-24
Mozilla Suite: Multiple vulnerabilities

Source: CCN
Type: GLSA-200608-02
Mozilla SeaMonkey: Multiple vulnerabilities

Source: CCN
Type: GLSA-200608-03
Mozilla Firefox: Multiple vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200608-03

Source: CCN
Type: GLSA-200608-04
Mozilla Thunderbird: Multiple vulnerabilities

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:143

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:145

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:146

Source: CCN
Type: MFSA 2006-47
Native DOM methods can be hijacked across domains

Source: CONFIRM
Type: Vendor Advisory
http://www.mozilla.org/security/announce/2006/mfsa2006-47.html

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:048

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0594

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0608

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0610

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0611

Source: BUGTRAQ
Type: UNKNOWN
20060727 rPSA-2006-0137-1 firefox

Source: HP
Type: UNKNOWN
SSRT061236

Source: HP
Type: UNKNOWN
SSRT061181

Source: BID
Type: Patch
19181

Source: CCN
Type: BID-19181
Mozilla Multiple Products Remote Vulnerabilities

Source: CCN
Type: USN-327-1
Firefox vulnerabilities

Source: CCN
Type: USN-327-2
Firefox regression

Source: CCN
Type: USN-329-1
Thunderbird vulnerabilities

Source: CCN
Type: USN-350-1
Thunderbird vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-350-1

Source: CCN
Type: USN-354-1
Firefox vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-354-1

Source: CCN
Type: US-CERT Technical Cyber Security Alert TA06-208A
Mozilla Products Contain Multiple Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2006-2998

Source: VUPEN
Type: UNKNOWN
ADV-2006-3748

Source: VUPEN
Type: UNKNOWN
ADV-2006-3749

Source: VUPEN
Type: UNKNOWN
ADV-2008-0083

Source: XF
Type: UNKNOWN
mozilla-dom-method-xss(27983)

Source: XF
Type: UNKNOWN
mozilla-dom-method-xss(27983)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-536

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-537

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9611

Source: UBUNTU
Type: UNKNOWN
USN-327-1

Source: UBUNTU
Type: UNKNOWN
USN-329-1

Source: SUSE
Type: SUSE-SA:2006:048
Mozilla Firefox Thunderbird and Seamonkey security problems

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0:*:dev:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5:-:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:seamonkey:1.0::dev:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5:-:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:thunderbird:1.5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20063802
    V
    		CVE-2006-3802
    2015-11-16
    oval:org.mitre.oval:def:9611
    V
    		Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
    2013-04-29
    oval:com.redhat.rhsa:def:20060609
    P
    		RHSA-2006:0609: seamonkey security update (Critical)
    2006-08-02
    oval:com.redhat.rhsa:def:20060611
    P
    		RHSA-2006:0611: thunderbird security update (Critical)
    2006-07-29
    oval:com.redhat.rhsa:def:20060610
    P
    		RHSA-2006:0610: firefox security update (Critical)
    2006-07-28
    oval:com.redhat.rhsa:def:20060608
    P
    		RHSA-2006:0608: seamonkey security update (Critical)
    2006-07-27
    BACK
    mozilla firefox 1.5
    mozilla firefox 1.5.0.1
    mozilla firefox 1.5.0.2
    mozilla firefox 1.5.0.3
    mozilla firefox 1.5.0.4
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0.1
    mozilla seamonkey 1.0.2
    mozilla thunderbird 1.5
    mozilla thunderbird 1.5.0.2
    mozilla thunderbird 1.5.0.4
    mozilla seamonkey 1.0
    mozilla firefox 1.5
    mozilla thunderbird 1.5
    mozilla firefox 1.5.0.2
    mozilla firefox 1.5.0.3
    mozilla firefox 1.5.0.4
    mozilla seamonkey 1.0.2
    mozilla thunderbird 1.5.0.4
    mozilla thunderbird 1.5.0.3
    mozilla thunderbird 1.5.0.2
    mozilla thunderbird 1.5.0.1
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0.1
    mozilla firefox 1.5.0.1
    gentoo linux *
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    suse suse linux 9.2
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    suse suse linux 10.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 2006
    canonical ubuntu 6.06
    suse suse linux 10.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux corporate server 3.0
    suse suse linux 9.3