MitreCVE-2006-2779

HistoryJun 02, 2006 - 7:02 p.m.

CVE-2006-2779

2006-06-0219:02:00

CWE-94

mitre

web.nvd.nist.gov

cve-2006-2779

mozilla firefox

thunderbird

denial of service

code execution

remote attackers

domnoderemoved

xbl

memory corruption

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.972

Percentile

99.8%

JSON

Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) nested <option> tags in a select tag, (2) a DOMNodeRemoved mutation event, (3) “Content-implemented tree views,” (4) BoxObjects, (5) the XBL implementation, (6) an iframe that attempts to remove itself, which leads to memory corruption.

Affected configurations

Nvd

Node

mozillafirefoxMatch0.8

mozillafirefoxMatch0.9

mozillafirefoxMatch0.9rc

mozillafirefoxMatch0.9.1

mozillafirefoxMatch0.9.2

mozillafirefoxMatch0.9.3

mozillafirefoxMatch0.10

mozillafirefoxMatch0.10.1

mozillafirefoxMatch1.0

mozillafirefoxMatch1.0.1

mozillafirefoxMatch1.0.2

mozillafirefoxMatch1.0.3

mozillafirefoxMatch1.0.4

mozillafirefoxMatch1.0.5

mozillafirefoxMatch1.0.6

mozillafirefoxMatch1.0.7

mozillafirefoxMatch1.0.8

mozillafirefoxMatch1.5

mozillafirefoxMatch1.5beta1

mozillafirefoxMatch1.5beta2

mozillafirefoxMatch1.5.0.2

mozillafirefoxMatch1.5.1

mozillafirefoxMatch1.5.2

mozillafirefoxMatch1.5.3

mozillafirefoxMatchpreview_release

mozillathunderbirdMatch0.6

mozillathunderbirdMatch0.7

mozillathunderbirdMatch0.7.1

mozillathunderbirdMatch0.7.2

mozillathunderbirdMatch0.7.3

mozillathunderbirdMatch0.8

mozillathunderbirdMatch0.9

mozillathunderbirdMatch1.0

mozillathunderbirdMatch1.0.1

mozillathunderbirdMatch1.0.2

mozillathunderbirdMatch1.0.5

mozillathunderbirdMatch1.0.6

mozillathunderbirdMatch1.0.7

mozillathunderbirdMatch1.0.8

mozillathunderbirdMatch1.5

mozillathunderbirdMatch1.5beta2

mozillathunderbirdMatch1.5.1

mozillathunderbirdMatch1.5.2

VendorProductVersionCPE
mozillafirefox0.8cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
mozillafirefox0.9cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
mozillafirefox0.9cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
mozillafirefox0.9.1cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
mozillafirefox0.9.2cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
mozillafirefox0.9.3cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
mozillafirefox0.10cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
mozillafirefox0.10.1cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
mozillafirefox1.0cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
mozillafirefox1.0.1cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	0.8	cpe:2.3:a:mozilla:firefox:0.8:::::::*
mozilla	firefox	0.9	cpe:2.3:a:mozilla:firefox:0.9:::::::*
mozilla	firefox	0.9	cpe:2.3:a:mozilla:firefox:0.9:rc::::::
mozilla	firefox	0.9.1	cpe:2.3:a:mozilla:firefox:0.9.1:::::::*
mozilla	firefox	0.9.2	cpe:2.3:a:mozilla:firefox:0.9.2:::::::*
mozilla	firefox	0.9.3	cpe:2.3:a:mozilla:firefox:0.9.3:::::::*
mozilla	firefox	0.10	cpe:2.3:a:mozilla:firefox:0.10:::::::*
mozilla	firefox	0.10.1	cpe:2.3:a:mozilla:firefox:0.10.1:::::::*
mozilla	firefox	1.0	cpe:2.3:a:mozilla:firefox:1.0:::::::*
mozilla	firefox	1.0.1	cpe:2.3:a:mozilla:firefox:1.0.1:::::::*

Rows per page:

1-10 of 431

References

rhn.redhat.com/errata/RHSA-2006-0609.html

secunia.com/advisories/20376

secunia.com/advisories/20382

secunia.com/advisories/20561

secunia.com/advisories/20709

secunia.com/advisories/21134

secunia.com/advisories/21176

secunia.com/advisories/21178

secunia.com/advisories/21183

secunia.com/advisories/21188

secunia.com/advisories/21210

secunia.com/advisories/21269

secunia.com/advisories/21270

secunia.com/advisories/21324

secunia.com/advisories/21336

secunia.com/advisories/21532

secunia.com/advisories/21607

secunia.com/advisories/21631

secunia.com/advisories/21634

secunia.com/advisories/21654

secunia.com/advisories/22065

secunia.com/advisories/22066

secunia.com/advisories/27216

securitytracker.com/id?1016202

securitytracker.com/id?1016214

sunsolve.sun.com/search/document.do?assetkey=1-26-102943-1

sunsolve.sun.com/search/document.do?assetkey=1-66-200387-1

www.debian.org/security/2006/dsa-1118

www.debian.org/security/2006/dsa-1120

www.debian.org/security/2006/dsa-1134

www.debian.org/security/2006/dsa-1159

www.debian.org/security/2006/dsa-1160

www.gentoo.org/security/en/glsa/glsa-200606-12.xml

www.gentoo.org/security/en/glsa/glsa-200606-21.xml

www.kb.cert.org/vuls/id/466673

www.mandriva.com/security/advisories?name=MDKSA-2006:143

www.mandriva.com/security/advisories?name=MDKSA-2006:145

www.mandriva.com/security/advisories?name=MDKSA-2006:146

www.mozilla.org/security/announce/2006/mfsa2006-32.html

www.novell.com/linux/security/advisories/2006_35_mozilla.html

www.redhat.com/support/errata/RHSA-2006-0578.html

www.redhat.com/support/errata/RHSA-2006-0594.html

www.redhat.com/support/errata/RHSA-2006-0610.html

www.redhat.com/support/errata/RHSA-2006-0611.html

www.securityfocus.com/archive/1/435795/100/0/threaded

www.securityfocus.com/archive/1/446657/100/200/threaded

www.securityfocus.com/archive/1/446658/100/200/threaded

www.securityfocus.com/bid/18228

www.us-cert.gov/cas/techalerts/TA06-153A.html

www.vupen.com/english/advisories/2006/2106

www.vupen.com/english/advisories/2006/3748

www.vupen.com/english/advisories/2006/3749

www.vupen.com/english/advisories/2007/3488

www.vupen.com/english/advisories/2008/0083

exchange.xforce.ibmcloud.com/vulnerabilities/26843

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9762

usn.ubuntu.com/296-1/

usn.ubuntu.com/296-2/

usn.ubuntu.com/297-1/

usn.ubuntu.com/297-3/

usn.ubuntu.com/323-1/

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.972

Percentile

99.8%

JSON

Related for CVE-2006-2779