PT-2006-1371 · Mozilla · Firefox+2

Georgi Guninski · Publicado 2006-02-02 · Atualizado 2018-10-19 · CVE-2006-0297

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 1.5 Thunderbird versions 1.5 SeaMonkey versions prior to 1.0

Description The issue is related to multiple integer overflows that could allow remote attackers to execute arbitrary code. This is possible via the EscapeAttributeValue in jsxml.c for E4X, nsSVGCairoSurface::Init in SVG, and nsCanvasRenderingContext2D.cpp in Canvas, when Javascript is enabled in mail.

Recommendations For Mozilla Firefox version 1.5, update to a version that contains a fix for this issue. For Thunderbird version 1.5, update to a version that contains a fix for this issue. For SeaMonkey versions prior to 1.0, update to version 1.0 or later.

Correção

Identificadores relacionados

CVE-2006-0297

Produtos afetados

Firefox

Seamonkey

Thunderbird

Referências · 17

• http://securityfocus.com/bid/16476 · Nota
• http://vupen.com/english/advisories/2006/0413 · Nota
• https://osv.dev/vulnerability/CVE-2006-0297 · Aviso do Fabricante
• http://securityfocus.com/archive/1/446657/100/200/threaded · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=322215 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0297 · Nota de Segurança
• http://secunia.com/advisories/22065 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24435 · Nota
• http://secunia.com/advisories/18704 · Nota
• https://bugzilla.mozilla.org/show_bug.cgi?id=319872 · Nota
• http://mozilla.org/security/announce/2006/mfsa2006-06.html · Nota
• http://securitytracker.com/id?1015570 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0297 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/3749 · Nota
• https://security-tracker.debian.org/tracker/CVE-2006-0297 · Aviso do Fabricante