CVE-2006-4340: mozilla firefox Improper Input Validation

CVSS: 4.0v2.0MediumModified

AliasesDEBIAN-CVE-2006-4340

Published 15-09-2006Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2006-4340 is a medium (CVSS 4.0) Improper Input Validation vulnerability in mozilla firefox. EPSS estimates a 2.32% chance of exploitation in the next 30 days, higher than 83.2% of scored vulnerabilities.

Overall risk

16/100

0100

Low · default modelHow is this calculated?

CVSS score

4.0/10

010

Medium · v2.0 (NVD)

EPSS score

2.32%

0%100%

Low · +0.04 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Duplicates 1

DSA-1191-1 DSA-1192-1 DSA-1210 DSA-1210-1 RHSA-2006:0675 RHSA-2006:0676+2 more

Timeline

15-09-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339. NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.

CVSS metrics

1 score · 1 source · 1 version

v2.04.0

EPSS trend

Probability

2.32%

Chance of exploitation in the next 30 days

Percentile

83%

Versus all other CVEs

30-day change

+0.04 pp

From 2.28% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Mozilla4 products

firefox≤ 1.5.0.6
network_security_services≤ 3.11.2
seamonkey≤ 1.0.4
thunderbird≤ 1.5.0.6

Debian1 product

thunderbird< 1.5.0.7-1

2 vendors · 5 products

References

73 links

www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/X Refsource MISC
securitytracker.com/id?1016858VDB EntryX Refsource SECTRACK
secunia.com/advisories/22992Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/3748VDB EntryX Refsource VUPEN
securitytracker.com/id?1016859VDB EntryX Refsource SECTRACK
www.redhat.com/support/errata/RHSA-2006-0676.htmlVendor AdvisoryX Refsource REDHATPatch
secunia.com/advisories/23883Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/3899VDB EntryX Refsource VUPEN
secunia.com/advisories/22044Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22055Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Show all 73 references

secunia.com/advisories/22195Third Party AdvisoryX Refsource SECUNIA
www.ubuntu.com/usn/usn-361-1Vendor AdvisoryX Refsource UBUNTU
www.ubuntu.com/usn/usn-352-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/22446Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21950Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.ubuntu.com/usn/usn-351-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/22025Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/22056Third Party AdvisoryX Refsource SECUNIA
www.imc.org/ietf-openpgp/mail-archive/msg14307.htmlMailing ListX Refsource MLIST
www.us-cert.gov/cas/techalerts/TA06-312A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/22247Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:168Vendor AdvisoryX Refsource MANDRIVA
www.us.debian.org/security/2006/dsa-1191Vendor AdvisoryX Refsource DEBIAN
www.vupen.com/english/advisories/2007/0293VDB EntryX Refsource VUPEN
secunia.com/advisories/22210Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.debian.org/security/2006/dsa-1210Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/24711Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/3622VDB EntryX Refsource VUPEN
www.mozilla.org/security/announce/2006/mfsa2006-60.htmlX Refsource CONFIRM
support.avaya.com/elmodocs2/security/ASA-2006-224.htmX Refsource CONFIRM
securitytracker.com/id?1016860VDB EntryX Refsource SECTRACK
secunia.com/advisories/22849Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0083VDB EntryX Refsource VUPEN
secunia.com/advisories/21939Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2006/3617VDB EntryX Refsource VUPEN
www.gentoo.org/security/en/glsa/glsa-200610-06.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/21915Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2007/1198VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2006-0677.htmlVendor AdvisoryX Refsource REDHATPatch
www.debian.org/security/2006/dsa-1192Vendor AdvisoryX Refsource DEBIAN
support.avaya.com/elmodocs2/security/ASA-2006-250.htmX Refsource CONFIRM
security.gentoo.org/glsa/glsa-200609-19.xmlVendor AdvisoryX Refsource GENTOO
www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742Vendor AdvisoryX Refsource HP
secunia.com/advisories/22274Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2006-0675.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/21940Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/30098VDB EntryX Refsource XF
sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/22001Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/446140/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/21903Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.ubuntu.com/usn/usn-350-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/21906Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
secunia.com/advisories/22342Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security.gentoo.org/glsa/glsa-200610-01.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/22074Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/22226Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/22066Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/22088Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/21949Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.novell.com/linux/security/advisories/2006_54_mozilla.htmlVendor AdvisoryX Refsource SUSE
issues.rpath.com/browse/RPL-640X Refsource CONFIRM
www.mozilla.org/security/announce/2006/mfsa2006-66.htmlX Refsource MISC
secunia.com/advisories/22036Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.novell.com/linux/security/advisories/2006_55_ssl.htmlVendor AdvisoryX Refsource SUSE
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11007VDB EntrySignatureX Refsource OVAL
www.ubuntu.com/usn/usn-354-1Vendor AdvisoryX Refsource UBUNTU
sunsolve.sun.com/search/document.do?assetkey=1-26-102781-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/22422Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/22299Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2006:169Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/21916Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security-tracker.debian.org/tracker/CVE-2006-4340Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities