CVE-2006-4567: mozilla firefox
Vulnerability summary
CVE-2006-4567 is a low (CVSS 2.6) vulnerability in mozilla firefox. EPSS estimates a 1.94% chance of exploitation in the next 30 days, higher than 79.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 15-09-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update mechanism, which might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site, which can then be used to install arbitrary code on the next update.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.94%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
+0.04 pp
From 1.90% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (mozilla.org)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mozilla2 products
- firefox≤ 1.5.0.6
- thunderbird≤ 1.5.0.6
Debian1 product
- thunderbird< 1.5.0.7-1
2 vendors · 3 products
References
41 linksShow all 41 references
- support.avaya.com/elmodocs2/security/ASA-2006-224.htmX Refsource CONFIRM
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10488VDB EntrySignatureX Refsource OVAL
- issues.rpath.com/browse/RPL-640X Refsource CONFIRM
