PT-2006-1930 · Mozilla+2 · Thunderbird+2

Georgi Guninski · Published 2006-02-24 · Updated 2018-10-18 · CVE-2006-0884

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions 1.0.7 and earlier

Description The issue allows attackers to bypass javascript security settings and obtain sensitive information or cause a crash. This is achieved through an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.

Recommendations For Mozilla Thunderbird versions 1.0.7 and earlier, consider disabling the WYSIWYG rendering engine or restricting the use of javascript in e-mails to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2006-0884

DSA-1046-1

DSA-1051-1

HPSBUX02122

RHSA-2006:0329

RHSA-2006:0330

RHSA-2006_0329

RHSA-2006_0330

Affected Products

Hp-Ux

Thunderbird

Red Hat

References · 99

• 🔥 http://securityfocus.com/bid/16770 · Exploit
• 🔥 http://securitytracker.com/id?1015665 · Exploit
• 🔥 https://exploit-db.com/exploits/27257 · Exploit
• http://mozilla.org/security/announce/2006/mfsa2006-21.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736 · Security Note
• http://securityfocus.com/archive/1/446657/100/200/threaded · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:078 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0329.html · Vendor Advisory
• http://secunia.com/advisories/19823 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728 · Security Note
• ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727 · Security Note