Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2006-0296

Published: 02/02/2006 Updated: 19/10/2018
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 540
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Subscribe to Mozilla

Vulnerability Summary

The XULDocument.persist function in Mozilla, Firefox prior to 1.5.0.1, and SeaMonkey prior to 1.0 does not validate the attribute name, which allows remote malicious users to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.

Vulnerable Product Search on Vulmon Subscribe to Product

mozilla firefox 0.8

mozilla firefox 0.9

mozilla firefox 1.0.2

mozilla firefox 1.0.3

mozilla firefox 1.5

mozilla seamonkey 1.0

mozilla firefox 0.9.3

mozilla firefox 1.0.6

mozilla firefox 0.9.1

mozilla firefox 0.9.2

mozilla firefox 1.0.4

mozilla firefox 1.0.5

mozilla firefox 0.10

mozilla firefox 0.10.1

mozilla firefox 1.0

mozilla firefox 1.0.1

mozilla firefox 1.0.7

Vendor Advisories

Ubuntu Security Notice: mozilla-thunderbird vulnerabilities
Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables Under some rare circumstances, a malicious mail with embedded JavaScript could exploit this to execute arbitrary code with the privileges of the user (CVE-2006-0292, CVE-2006-1742) ...
Ubuntu Security Notice: mozilla vulnerabilities
Web pages with extremely long titles caused subsequent launches of Mozilla browser to hang for up to a few minutes, or caused Mozilla to crash on computers with insufficient memory (CVE-2005-4134) ...
Ubuntu Security Notice: mozilla-firefox, firefox vulnerabilities
Web pages with extremely long titles caused subsequent launches of Firefox browser to hang for up to a few minutes, or caused Firefox to crash on computers with insufficient memory (CVE-2005-4134) ...
Mozilla: Localstore.rdf XML injection through XULDocument.persist()
Mozilla Foundation Security Advisory 2006-05 Localstorerdf XML injection through XULDocumentpersist() Announced February 1, 2006 Reporter moz_bug_r_a4 Impact Critical Products Firefox, Mozilla Suite, SeaMonkey, Thunderbird ...

References

NVD-CWE-Otherhttps://bugzilla.mozilla.org/show_bug.cgi?id=319847http://www.redhat.com/support/errata/RHSA-2006-0199.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0200.htmlhttp://www.securityfocus.com/bid/16476http://secunia.com/advisories/18700http://secunia.com/advisories/18703http://secunia.com/advisories/18704http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00005.htmlhttp://www.redhat.com/archives/fedora-announce-list/2006-February/msg00006.htmlhttp://www.kb.cert.org/vuls/id/592425http://securitytracker.com/id?1015570http://secunia.com/advisories/18708http://secunia.com/advisories/18709http://secunia.com/advisories/18705http://secunia.com/advisories/18706ftp://patches.sgi.com/support/free/security/advisories/20060201-01-Uhttp://secunia.com/advisories/19230http://www.debian.org/security/2006/dsa-1044http://www.gentoo.org/security/en/glsa/glsa-200604-12.xmlhttp://secunia.com/advisories/19759http://secunia.com/advisories/19821http://www.debian.org/security/2006/dsa-1046http://www.gentoo.org/security/en/glsa/glsa-200604-18.xmlhttp://secunia.com/advisories/19823http://secunia.com/advisories/19852http://secunia.com/advisories/19862http://secunia.com/advisories/19863http://secunia.com/advisories/19902http://www.debian.org/security/2006/dsa-1051http://secunia.com/advisories/19950http://secunia.com/advisories/19941http://secunia.com/advisories/19746http://www.gentoo.org/security/en/glsa/glsa-200605-09.xmlhttp://www.redhat.com/support/errata/RHSA-2006-0330.htmlftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txthttp://secunia.com/advisories/21033http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1http://secunia.com/advisories/21622http://www.mozilla.org/security/announce/2006/mfsa2006-05.htmlhttp://support.avaya.com/elmodocs2/security/ASA-2006-205.htmhttp://secunia.com/advisories/19780http://secunia.com/advisories/20051http://www.mandriva.com/security/advisories?name=MDKSA-2006:036http://www.mandriva.com/security/advisories?name=MDKSA-2006:078http://www.mandriva.com/security/advisories?name=MDKSA-2006:037http://www.us-cert.gov/cas/techalerts/TA06-038A.htmlhttp://secunia.com/advisories/22065http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1http://www.vupen.com/english/advisories/2006/3749http://www.vupen.com/english/advisories/2006/3391http://www.novell.com/linux/security/advisories/2006_04_25.htmlhttp://www.vupen.com/english/advisories/2006/0413https://exchange.xforce.ibmcloud.com/vulnerabilities/24434https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1493https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11803https://usn.ubuntu.com/276-1/https://usn.ubuntu.com/275-1/https://usn.ubuntu.com/271-1/http://www.securityfocus.com/archive/1/446657/100/200/threadedhttp://www.securityfocus.com/archive/1/438730/100/0/threadedhttp://www.securityfocus.com/archive/1/425978/100/0/threadedhttp://www.securityfocus.com/archive/1/425975/100/0/threadedhttps://nvd.nist.govhttps://usn.ubuntu.com/276-1/https://www.kb.cert.org/vuls/id/592425
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-26925CVE-2023-41826LFICVE-2022-22364CVE-2024-2887command injectionremote code executionCVE-2024-34446CVE-2022-48699
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook