CVE-2006-2783: mozilla firefox Cross-site Scripting

CVSS: 4.3v2.0MediumModified

AliasesDEBIAN-CVE-2006-2783

Published 02-06-2006Last modified 07-08-2024

Vulnerability summary

CVE-2006-2783 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in mozilla firefox. EPSS estimates a 1.67% chance of exploitation in the next 30 days, higher than 76.4% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

1.67%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7

DSA-1118 DSA-1120 DSA-1134-1 RHSA-2006:0578 RHSA-2006:0609 RHSA-2006:0610+1 more

Timeline

02-06-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark (BOM) from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

1.67%

Chance of exploitation in the next 30 days

Percentile

76%

Versus all other CVEs

30-day change

0.00 pp

From 1.67% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.67%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Mozilla2 products

firefox≤ 1.5.0.3
thunderbird≤ 1.5.0.3

Debian1 product

thunderbird< 1.5.0.4-1

2 vendors · 3 products

References

59 links

secunia.com/advisories/20709Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21176Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:145Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2006/3748VDB EntryX Refsource VUPEN
usn.ubuntu.com/297-3/Vendor AdvisoryX Refsource UBUNTU
usn.ubuntu.com/296-1/Vendor AdvisoryX Refsource UBUNTU
usn.ubuntu.com/323-1/Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/20561Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/21210Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Show all 59 references

www.redhat.com/support/errata/RHSA-2006-0594.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/21336Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/20382Third Party AdvisoryX Refsource SECUNIAVendor Advisory
securitytracker.com/id?1016214VDB EntryX Refsource SECTRACK
www.securityfocus.com/archive/1/435795/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2006/3749VDB EntryX Refsource VUPEN
www.vupen.com/english/advisories/2009/1522VDB EntryX Refsource VUPENVendor Advisory
www.redhat.com/support/errata/RHSA-2006-0610.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/20376Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:146Vendor AdvisoryX Refsource MANDRIVA
rhn.redhat.com/errata/RHSA-2006-0609.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/21178Third Party AdvisoryX Refsource SECUNIAVendor Advisory
securitytracker.com/id?1016202VDB EntryX Refsource SECTRACK
secunia.com/advisories/21607Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/18228VDB EntryX Refsource BID
secunia.com/advisories/21532Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21270Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/0083VDB EntryX Refsource VUPEN
secunia.com/advisories/21188Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21134Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21631Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/446658/100/200/threadedVendor AdvisoryX Refsource HP
www.securityfocus.com/archive/1/446657/100/200/threadedVendor AdvisoryX Refsource HP
secunia.com/advisories/35379Third Party AdvisoryX Refsource SECUNIA
usn.ubuntu.com/296-2/Vendor AdvisoryX Refsource UBUNTU
www.gentoo.org/security/en/glsa/glsa-200606-21.xmlVendor AdvisoryX Refsource GENTOO
www.debian.org/security/2006/dsa-1118Vendor AdvisoryX Refsource DEBIAN
www.debian.org/security/2006/dsa-1120Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/support/errata/RHSA-2006-0611.htmlVendor AdvisoryX Refsource REDHAT
exchange.xforce.ibmcloud.com/vulnerabilities/26852VDB EntryX Refsource XF
lists.apple.com/archives/security-announce/2008//Jul/msg00001.htmlVendor AdvisoryX Refsource APPLE
www.debian.org/security/2006/dsa-1134Vendor AdvisoryX Refsource DEBIAN
www.gentoo.org/security/en/glsa/glsa-200606-12.xmlVendor AdvisoryX Refsource GENTOO
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10772VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/21324Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21183Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2008/2094/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/22066Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21269Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.novell.com/linux/security/advisories/2006_35_mozilla.htmlVendor AdvisoryX Refsource SUSE
support.apple.com/kb/HT3613X Refsource CONFIRM
usn.ubuntu.com/297-1/Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2006-0578.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2006/2106VDB EntryX Refsource VUPEN
www.mandriva.com/security/advisories?name=MDKSA-2006:143Vendor AdvisoryX Refsource MANDRIVA
www.mozilla.org/security/announce/2006/mfsa2006-42.htmlX Refsource CONFIRM
secunia.com/advisories/22065Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/31074Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security-tracker.debian.org/tracker/CVE-2006-2783Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities