PT-2006-3702 · Mozilla+1 · Firefox+2

Masatoshi Kimura

·

Published

2006-06-02

·

Updated

2018-10-18

·

CVE-2006-2783

CVSS v2.0

4.3

Medium

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 1.5.0.4 Mozilla Thunderbird versions prior to 1.5.0.4
Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a Unicode Byte-order-Mark (BOM) sequence in the middle of a dangerous tag such as SCRIPT. This occurs because the software strips the BOM from a UTF-8 page before it is passed to the parser.
Recommendations For Mozilla Firefox versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue. For Mozilla Thunderbird versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-2783
DSA-1118
DSA-1120
DSA-1134-1
HPSBUX02153
RHSA-2006:0578
RHSA-2006:0609
RHSA-2006:0610
RHSA-2006:0611
RHSA-2006_0609
RHSA-2006_0610
RHSA-2006_0611

Affected Products

Firefox
Thunderbird
Red Hat