PT-2006-4664 · Mozilla+1 · Thunderbird+2

Daniel Veditz · Published 2006-07-27 · Updated 2018-10-17 · CVE-2006-3804

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Thunderbird versions prior to 1.5.0.5 SeaMonkey versions prior to 1.0.3

Description The issue is related to a heap-based buffer overflow that can be triggered by a VCard attachment containing a malformed base64 field. This field causes an integer underflow, leading to more data being copied than expected, which can result in a denial of service (crash).

Recommendations For Mozilla Thunderbird versions prior to 1.5.0.5, update to version 1.5.0.5 or later to resolve the issue. For SeaMonkey versions prior to 1.0.3, update to version 1.0.3 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2006-3804

RHSA-2006:0608

RHSA-2006:0609

RHSA-2006:0611

RHSA-2006_0609

RHSA-2006_0611

Affected Products

Thunderbird

Red Hat

Seamonkey

References · 81

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/mozilla_navigatorjava.rb · Exploit
• http://redhat.com/support/errata/RHSA-2006-0608.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:143 · Vendor Advisory
• http://securityfocus.com/archive/1/446657/100/200/threaded · Vendor Advisory
• http://ubuntu.com/usn/usn-350-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-3804 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3804 · Security Note
• http://secunia.com/advisories/21228 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01281 · Security Note
• http://security.gentoo.org/glsa/glsa-200608-04.xml · Vendor Advisory
• http://secunia.com/advisories/21229 · Vendor Advisory
• http://securityfocus.com/bid/19181 · Patch
• http://mozilla.org/security/announce/2006/mfsa2006-49.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200608-02.xml · Vendor Advisory