{"schemaVersion":3,"id":"CVE-2006-0296","aliases":["DEBIAN-CVE-2006-0296"],"status":"published","duplicateOf":null,"title":null,"description":"The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.","dates":{"published":"2006-02-02T20:00:00.000Z","modified":"2024-08-07T16:25:34.133Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.04136,"percentile":0.9072,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.04136},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04136,"percentile":0.9072}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.04136,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.04136,"percentile":0.9072}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"debian","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/thunderbird","purlType":"deb","versions":[{"text":"< 1.5.0.2-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.0.2-1","eol":null,"hubHref":null},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"0.8","noFixRecorded":false,"fixedIn":null},{"text":"0.9","noFixRecorded":false,"fixedIn":null},{"text":"0.9:rc","noFixRecorded":false,"fixedIn":null},{"text":"0.9.1","noFixRecorded":false,"fixedIn":null},{"text":"0.9.2","noFixRecorded":false,"fixedIn":null},{"text":"0.9.3","noFixRecorded":false,"fixedIn":null},{"text":"0.10","noFixRecorded":false,"fixedIn":null},{"text":"0.10.1","noFixRecorded":false,"fixedIn":null},{"text":"1.0","noFixRecorded":false,"fixedIn":null},{"text":"1.0.1","noFixRecorded":false,"fixedIn":null},{"text":"1.0.2","noFixRecorded":false,"fixedIn":null},{"text":"1.0.3","noFixRecorded":false,"fixedIn":null},{"text":"1.0.4","noFixRecorded":false,"fixedIn":null},{"text":"1.0.5","noFixRecorded":false,"fixedIn":null},{"text":"1.0.6","noFixRecorded":false,"fixedIn":null},{"text":"1.0.7","noFixRecorded":false,"fixedIn":null},{"text":"1.5","noFixRecorded":false,"fixedIn":null},{"text":"1.5:beta1","noFixRecorded":false,"fixedIn":null}],"versionsText":"0.8 | 0.9 | 0.9:rc | 0.9.1 | 0.9.2 | 0.9.3 | 0.10 | 0.10.1 | 1.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7 | 1.5 | 1.5:beta1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"seamonkey","name":"seamonkey","label":"seamonkey","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0","noFixRecorded":false,"fixedIn":null},{"text":"1.0:beta","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0 | 1.0:beta","eol":null,"hubHref":"/vendor/mozilla/seamonkey"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:036","label":"www.mandriva.com/security/advisories?name=MDKSA-2006:036","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"https://usn.ubuntu.com/275-1/","label":"usn.ubuntu.com/275-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://www.redhat.com/support/errata/RHSA-2006-0330.html","label":"www.redhat.com/support/errata/RHSA-2006-0330.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/19902","label":"secunia.com/advisories/19902","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:037","label":"www.mandriva.com/security/advisories?name=MDKSA-2006:037","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"https://usn.ubuntu.com/276-1/","label":"usn.ubuntu.com/276-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://www.securityfocus.com/archive/1/438730/100/0/threaded","label":"www.securityfocus.com/archive/1/438730/100/0/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://secunia.com/advisories/19941","label":"secunia.com/advisories/19941","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/19780","label":"secunia.com/advisories/19780","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/19821","label":"secunia.com/advisories/19821","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00005.html","label":"www.redhat.com/archives/fedora-announce-list/2006-February/msg00005.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml","label":"www.gentoo.org/security/en/glsa/glsa-200604-12.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://secunia.com/advisories/21622","label":"secunia.com/advisories/21622","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/19862","label":"secunia.com/advisories/19862","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/19230","label":"secunia.com/advisories/19230","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/18704","label":"secunia.com/advisories/18704","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm","label":"support.avaya.com/elmodocs2/security/ASA-2006-205.htm","hostname":"support.avaya.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/19823","label":"secunia.com/advisories/19823","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.debian.org/security/2006/dsa-1051","label":"www.debian.org/security/2006/dsa-1051","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://secunia.com/advisories/18709","label":"secunia.com/advisories/18709","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24434","label":"exchange.xforce.ibmcloud.com/vulnerabilities/24434","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.vupen.com/english/advisories/2006/3749","label":"www.vupen.com/english/advisories/2006/3749","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"https://usn.ubuntu.com/271-1/","label":"usn.ubuntu.com/271-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://secunia.com/advisories/18705","label":"secunia.com/advisories/18705","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml","label":"www.gentoo.org/security/en/glsa/glsa-200604-18.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://www.securityfocus.com/bid/16476","label":"www.securityfocus.com/bid/16476","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.vupen.com/english/advisories/2006/0413","label":"www.vupen.com/english/advisories/2006/0413","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://securitytracker.com/id?1015570","label":"securitytracker.com/id?1015570","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://secunia.com/advisories/19746","label":"secunia.com/advisories/19746","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/21033","label":"secunia.com/advisories/21033","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.kb.cert.org/vuls/id/592425","label":"www.kb.cert.org/vuls/id/592425","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=319847","label":"bugzilla.mozilla.org/show_bug.cgi?id=319847","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11803","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11803","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/18700","label":"secunia.com/advisories/18700","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://secunia.com/advisories/19759","label":"secunia.com/advisories/19759","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.mozilla.org/security/announce/2006/mfsa2006-05.html","label":"www.mozilla.org/security/announce/2006/mfsa2006-05.html","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/446657/100/200/threaded","label":"www.securityfocus.com/archive/1/446657/100/200/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://www.redhat.com/support/errata/RHSA-2006-0200.html","label":"www.redhat.com/support/errata/RHSA-2006-0200.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/18706","label":"secunia.com/advisories/18706","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1493","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1493","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00006.html","label":"www.redhat.com/archives/fedora-announce-list/2006-February/msg00006.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:078","label":"www.mandriva.com/security/advisories?name=MDKSA-2006:078","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2006-0199.html","label":"www.redhat.com/support/errata/RHSA-2006-0199.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA06-038A.html","label":"www.us-cert.gov/cas/techalerts/TA06-038A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://secunia.com/advisories/20051","label":"secunia.com/advisories/20051","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/19863","label":"secunia.com/advisories/19863","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/425978/100/0/threaded","label":"www.securityfocus.com/archive/1/425978/100/0/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://secunia.com/advisories/18708","label":"secunia.com/advisories/18708","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/425975/100/0/threaded","label":"www.securityfocus.com/archive/1/425975/100/0/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT"]},{"url":"http://secunia.com/advisories/19852","label":"secunia.com/advisories/19852","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.novell.com/linux/security/advisories/2006_04_25.html","label":"www.novell.com/linux/security/advisories/2006_04_25.html","hostname":"www.novell.com","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml","label":"www.gentoo.org/security/en/glsa/glsa-200605-09.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://www.vupen.com/english/advisories/2006/3391","label":"www.vupen.com/english/advisories/2006/3391","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/18703","label":"secunia.com/advisories/18703","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/22065","label":"secunia.com/advisories/22065","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/19950","label":"secunia.com/advisories/19950","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.debian.org/security/2006/dsa-1046","label":"www.debian.org/security/2006/dsa-1046","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://www.debian.org/security/2006/dsa-1044","label":"www.debian.org/security/2006/dsa-1044","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-0296","label":"security-tracker.debian.org/tracker/CVE-2006-0296","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-1044-1","DSA-1046-1","DSA-1051-1","RHSA-2006:0200","RHSA-2006:0330"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2006-02-02T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T16:25:34.133Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T07:00:41.439Z","stale":false,"partial":false}}