PT-2006-1371 · Mozilla · Firefox+2

Georgi Guninski · Published 2006-02-02 · Updated 2018-10-19 · CVE-2006-0297

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 1.5 Thunderbird versions 1.5 SeaMonkey versions prior to 1.0

Description The issue is related to multiple integer overflows that could allow remote attackers to execute arbitrary code. This is possible via the EscapeAttributeValue in jsxml.c for E4X, nsSVGCairoSurface::Init in SVG, and nsCanvasRenderingContext2D.cpp in Canvas, when Javascript is enabled in mail.

Recommendations For Mozilla Firefox version 1.5, update to a version that contains a fix for this issue. For Thunderbird version 1.5, update to a version that contains a fix for this issue. For SeaMonkey versions prior to 1.0, update to version 1.0 or later.

Fix

Related Identifiers

CVE-2006-0297

Affected Products

Firefox

Seamonkey

Thunderbird

References · 17

• https://osv.dev/vulnerability/CVE-2006-0297 · Vendor Advisory
• http://securityfocus.com/archive/1/446657/100/200/threaded · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0297 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0297 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-0297 · Vendor Advisory
• http://securityfocus.com/bid/16476 · Note
• http://vupen.com/english/advisories/2006/0413 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=322215 · Note
• http://secunia.com/advisories/22065 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24435 · Note
• http://secunia.com/advisories/18704 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=319872 · Note
• http://mozilla.org/security/announce/2006/mfsa2006-06.html · Note
• http://securitytracker.com/id?1015570 · Note
• http://vupen.com/english/advisories/2006/3749 · Note