CVE-2006-2780: mozilla firefox Code Injection

CVSS: 9.3v2.0HighModified

AliasesDEBIAN-CVE-2006-2780

Published 02-06-2006Last modified 07-08-2024

Vulnerability summary

CVE-2006-2780 is a high (CVSS 9.3) Code Injection vulnerability in mozilla firefox. EPSS estimates a 7.25% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

7.25%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7

DSA-1118 DSA-1120 DSA-1134-1 RHSA-2006:0578 RHSA-2006:0609 RHSA-2006:0610+1 more

Timeline

02-06-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Integer overflow in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via "jsstr tagify," which leads to memory corruption.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

7.25%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 7.25% on 19-09-2026

19-09-202619-10-2026

EPSS score

7.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Mozilla2 products

firefox≤ 1.5.0.3
thunderbird≤ 1.5.0.3

Debian1 product

thunderbird< 1.5.0.4-1

2 vendors · 3 products

References

58 links

secunia.com/advisories/27216Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/20709Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/security/announce/2006/mfsa2006-32.htmlX Refsource CONFIRM
secunia.com/advisories/21176Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2006:145Vendor AdvisoryX Refsource MANDRIVA
www.kb.cert.org/vuls/id/466673Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.vupen.com/english/advisories/2006/3748VDB EntryX Refsource VUPEN
usn.ubuntu.com/297-3/Vendor AdvisoryX Refsource UBUNTU
exchange.xforce.ibmcloud.com/vulnerabilities/26843VDB EntryX Refsource XF
usn.ubuntu.com/296-1/Vendor AdvisoryX Refsource UBUNTU

Show all 58 references

usn.ubuntu.com/323-1/Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/20561Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11305VDB EntrySignatureX Refsource OVAL
www.us-cert.gov/cas/techalerts/TA06-153A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/21210Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2006-0594.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/21336Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/20382Third Party AdvisoryX Refsource SECUNIA
securitytracker.com/id?1016214VDB EntryX Refsource SECTRACK
www.securityfocus.com/archive/1/435795/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2006/3749VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2006-0610.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/20376Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2006:146Vendor AdvisoryX Refsource MANDRIVA
rhn.redhat.com/errata/RHSA-2006-0609.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/21178Third Party AdvisoryX Refsource SECUNIA
securitytracker.com/id?1016202VDB EntryX Refsource SECTRACK
secunia.com/advisories/21607Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/18228VDB EntryX Refsource BID
secunia.com/advisories/21532Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/21270Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0083VDB EntryX Refsource VUPEN
www.vupen.com/english/advisories/2007/3488VDB EntryX Refsource VUPEN
secunia.com/advisories/21188Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/21134Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/21631Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/446658/100/200/threadedVendor AdvisoryX Refsource HP
www.securityfocus.com/archive/1/446657/100/200/threadedVendor AdvisoryX Refsource HP
usn.ubuntu.com/296-2/Vendor AdvisoryX Refsource UBUNTU
www.gentoo.org/security/en/glsa/glsa-200606-21.xmlVendor AdvisoryX Refsource GENTOO
www.debian.org/security/2006/dsa-1118Vendor AdvisoryX Refsource DEBIAN
sunsolve.sun.com/search/document.do?assetkey=1-66-200387-1Vendor AdvisoryX Refsource SUNALERT
www.debian.org/security/2006/dsa-1120Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/support/errata/RHSA-2006-0611.htmlVendor AdvisoryX Refsource REDHAT
www.debian.org/security/2006/dsa-1134Vendor AdvisoryX Refsource DEBIAN
www.gentoo.org/security/en/glsa/glsa-200606-12.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/21324Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/21183Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-102943-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/22066Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/21269Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2006_35_mozilla.htmlVendor AdvisoryX Refsource SUSE
usn.ubuntu.com/297-1/Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2006-0578.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2006/2106VDB EntryX Refsource VUPEN
www.mandriva.com/security/advisories?name=MDKSA-2006:143Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/22065Third Party AdvisoryX Refsource SECUNIA
security-tracker.debian.org/tracker/CVE-2006-2780Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities