PT-2006-2926 · Mozilla+4 · Firefox+4
Eric Foley
·
Published
2006-04-20
·
Updated
2018-10-18
·
CVE-2006-1942
CVSS v2.0
5.1
Medium
| Vector | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions 1.5.0.2 through 1.5.0.4
Netscape versions 7.2, 8.0.4, 8.1
K-Meleon version 0.9.13
Description
The issue allows user-assisted remote attackers to open local files via a web page with an
IMG element containing a SRC attribute with a non-image file:// URL. This can trick the user into selecting View Image for the broken image, potentially launching external applications such as Windows Media Player, or referencing an alternate web page.Recommendations
For Mozilla Firefox versions 1.5.0.2 through 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue.
For Netscape versions 7.2, 8.0.4, 8.1, consider disabling the
IMG element or restricting access to non-image files to minimize the risk of exploitation until a patch is available.
For K-Meleon version 0.9.13, restrict access to the file:// protocol in the SRC attribute of the IMG element to prevent the opening of local files.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hp-Ux
K-Meleon
Firefox
Netscape
Windows Media Player