Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2006-0884

Published: 24/02/2006 Updated: 18/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 935
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Mozilla

Vulnerability Summary

The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and previous versions allows user-assisted malicious users to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.

Vulnerable Product Search on Vulmon Subscribe to Product

mozilla thunderbird 1.0

mozilla thunderbird 0.7

mozilla thunderbird 0.7.1

mozilla thunderbird 0.3

mozilla thunderbird 0.4

mozilla thunderbird 0.7.2

mozilla thunderbird 0.7.3

mozilla thunderbird 0.5

mozilla thunderbird 0.6

mozilla thunderbird 1.0.1

mozilla thunderbird 1.0.2

mozilla thunderbird 1.0.5

mozilla thunderbird 0.8

mozilla thunderbird 0.9

mozilla thunderbird 1.0.6

mozilla thunderbird

mozilla thunderbird 0.1

mozilla thunderbird 0.2

Vendor Advisories

Ubuntu Security Notice: mozilla-thunderbird vulnerabilities
Igor Bukanov discovered that the JavaScript engine did not properly declare some temporary variables Under some rare circumstances, a malicious mail with embedded JavaScript could exploit this to execute arbitrary code with the privileges of the user (CVE-2006-0292, CVE-2006-1742) ...
Mozilla: JavaScript execution in mail when forwarding in-line
Mozilla Foundation Security Advisory 2006-21 JavaScript execution in mail when forwarding in-line Announced April 21, 2006 Reporter Georgi Guninski Impact Critical Products Mozilla Suite, SeaMonkey, Thunderbird Fixed in ...

Exploits

Exploit DB: Mozilla (Multiple Products) - iFrame JavaScript Execution
source: wwwsecurityfocuscom/bid/16770/info Multiple Mozilla products are prone to a script-execution vulnerability The vulnerability presents itself when an attacker supplies a specially crafted email to a user containing malicious script code in an IFRAME and the user tries to reply to the mail Arbitrary JavaScript can be executed ev ...

References

CWE-20http://www.securityfocus.com/bid/16770http://securitytracker.com/id?1015665http://secunia.com/advisories/19821http://www.debian.org/security/2006/dsa-1046http://www.gentoo.org/security/en/glsa/glsa-200604-18.xmlftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.aschttp://secunia.com/advisories/19811http://secunia.com/advisories/19823http://secunia.com/advisories/19863http://secunia.com/advisories/19902http://www.debian.org/security/2006/dsa-1051http://secunia.com/advisories/19950http://secunia.com/advisories/19941http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.htmlhttp://secunia.com/advisories/19721http://www.gentoo.org/security/en/glsa/glsa-200605-09.xmlhttp://www.redhat.com/support/errata/RHSA-2006-0329.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0330.htmlhttp://www.mozilla.org/security/announce/2006/mfsa2006-21.htmlftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txthttp://secunia.com/advisories/21033http://www.osvdb.org/23653http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1http://secunia.com/advisories/21622http://support.avaya.com/elmodocs2/security/ASA-2006-205.htmhttp://secunia.com/advisories/20051http://www.mandriva.com/security/advisories?name=MDKSA-2006:052http://www.mandriva.com/security/advisories?name=MDKSA-2006:076http://www.mandriva.com/security/advisories?name=MDKSA-2006:078http://secunia.com/advisories/22065http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1http://www.vupen.com/english/advisories/2006/3749http://www.novell.com/linux/security/advisories/2006_04_25.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/25983https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2024https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10782https://usn.ubuntu.com/276-1/http://www.securityfocus.com/archive/1/446657/100/200/threadedhttp://www.securityfocus.com/archive/1/438730/100/0/threadedhttp://www.securityfocus.com/archive/1/436296/100/0/threadedhttp://www.securityfocus.com/archive/1/425786/100/0/threadedhttps://usn.ubuntu.com/276-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/27257/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook