PT-2006-7540 · Mozilla+2 · Libnss-Dev+7

Georgi Guninski · Published 1970-01-01 · Updated 2017-10-11 · CVE-2006-4570

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libnspr4 versions prior to the fixed version Mozilla Thunderbird versions prior to 1.5.0.7 SeaMonkey versions prior to 1.0.5 libnss3 versions prior to the fixed version libnspr-dev versions prior to the fixed version libnss-dev versions prior to the fixed version

Description The issue concerns multiple vulnerabilities in the libnspr4, libnss3, libnspr-dev, and libnss-dev packages of the Debian GNU/Linux operating system, as well as in Mozilla Thunderbird and SeaMonkey. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. In the case of Mozilla Thunderbird and SeaMonkey, the vulnerabilities can be exploited when the "Load Images" option is enabled, allowing remote attackers to bypass JavaScript settings via a remote XBL file in a message.

Recommendations For libnspr4, update to a version that contains the fix for this issue. For Mozilla Thunderbird, update to version 1.5.0.7 or later. For SeaMonkey, update to version 1.0.5 or later. For libnss3, update to a version that contains the fix for this issue. For libnspr-dev, update to a version that contains the fix for this issue. For libnss-dev, update to a version that contains the fix for this issue.

Fix

Related Identifiers

BDU:2015-01278

BDU:2015-01279

BDU:2015-01280

BDU:2015-01281

CVE-2006-4570

DSA-1191-1

DSA-1192-1

RHSA-2006:0676

RHSA-2006:0677

RHSA-2006_0676

RHSA-2006_0677

Affected Products

Debian

Thunderbird

Red Hat

Seamonkey

Libnspr-Dev

Libnspr4

Libnss-Dev

Libnss3

References · 61

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4568 · Security Note
• http://security.gentoo.org/glsa/glsa-200610-04.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-350-1 · Vendor Advisory
• http://us.debian.org/security/2006/dsa-1191 · Vendor Advisory
• http://ubuntu.com/usn/usn-352-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01281 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4565 · Security Note
• https://bdu.fstec.ru/vul/2015-09530 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4570 · Security Note
• https://bdu.fstec.ru/vul/2016-02223 · Security Note
• http://mozilla.org/security/announce/2006/mfsa2006-63.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4570 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4566 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4571 · Security Note
• https://osv.dev/vulnerability/CVE-2006-4570 · Vendor Advisory