PT-2006-1369 · Mozilla · Firefox+2

Georgi - Hopefully Not Receiving Bugspam + 1 · Publicado 2006-02-02 · Atualizado 2018-10-19 · CVE-2006-0295

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox version 1.5 Thunderbird version 1.5 SeaMonkey versions prior to 1.0

Description The issue allows remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.

Recommendations For Mozilla Firefox version 1.5, update to a version that fixes the memory corruption issue. For Thunderbird version 1.5, consider disabling Javascript in mail as a temporary workaround until a patch is available. For SeaMonkey versions prior to 1.0, update to a version that fixes the memory corruption issue.

Exploit

Correção

Identificadores relacionados

CVE-2006-0295

Produtos afetados

Firefox

Seamonkey

Thunderbird

Referências · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_queryinterface.rb · Exploit
• 🔥 https://exploit-db.com/exploits/1474 · Exploit
• 🔥 https://exploit-db.com/exploits/1480 · Exploit
• 🔥 https://exploit-db.com/exploits/16301 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0295 · Nota de Segurança
• http://securityfocus.com/bid/16476 · Nota
• http://vupen.com/english/advisories/2006/0413 · Nota
• http://securityfocus.com/archive/1/446657/100/200/threaded · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=319296 · Correção
• http://secunia.com/advisories/22065 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0295 · Aviso do Fabricante
• http://secunia.com/advisories/18704 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1562 · Nota
• http://securitytracker.com/id?1015570 · Nota
• http://mozilla.org/security/announce/2006/mfsa2006-04.html · Nota