CVE-2006-6499: canonical ubuntu_linux Infinite Loop

CVSS: 4.3v2.0MediumModified

AliasesDEBIAN-CVE-2006-6499

Published 20-12-2006Last modified 07-08-2024

Vulnerability summary

CVE-2006-6499 is a medium (CVSS 4.3) Infinite Loop vulnerability in canonical ubuntu_linux. EPSS estimates a 3.94% chance of exploitation in the next 30 days, higher than 90.2% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

3.94%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

DSA-1253-1 DSA-1258-1 DSA-1265-1

Timeline

20-12-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins that reduce the precision.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

3.94%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

0.00 pp

From 3.94% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.94%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected systems

Mozilla3 products

firefox≥ 1.5, < 1.5.0.9 | ≥ 2.0, < 2.0.0.1
seamonkey< 1.0.7
thunderbird< 1.5.0.9

Debian2 products

firefox-esr< 45.0esr-1
debian_linuxEOL3.1 | 4.0

Canonical1 product

ubuntu_linuxEOL5.10 | 6.06 | 6.10

3 vendors · 6 products

References

35 links

www.securityfocus.com/bid/21668VDB EntryX Refsource BIDBroken LinkThird Party Advisory
secunia.com/advisories/23672Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2006/5068VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
securitytracker.com/id?1017398VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.debian.org/security/2007/dsa-1265Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/24078Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/23692Third Party AdvisoryX Refsource SECUNIABroken Link
www.ubuntu.com/usn/usn-398-2Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.gentoo.org/security/en/glsa/glsa-200701-04.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
secunia.com/advisories/23282Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 35 references

secunia.com/advisories/24390Third Party AdvisoryX Refsource SECUNIABroken Link
www.mozilla.org/security/announce/2006/mfsa2006-68.htmlX Refsource CONFIRMVendor Advisory
secunia.com/advisories/23422Third Party AdvisoryX Refsource SECUNIABroken Link
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Vendor AdvisoryX Refsource HPBroken Link
secunia.com/advisories/23591Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2007/1124VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
securitytracker.com/id?1017405VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/23614Third Party AdvisoryX Refsource SECUNIABroken Link
securitytracker.com/id?1017406VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.ubuntu.com/usn/usn-398-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.vupen.com/english/advisories/2008/0083VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
secunia.com/advisories/23420Third Party AdvisoryX Refsource SECUNIABroken Link
www.novell.com/linux/security/advisories/2006_80_mozilla.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.kb.cert.org/vuls/id/427972Third Party AdvisoryX Refsource CERT VNUS Government Resource
secunia.com/advisories/23545Third Party AdvisoryX Refsource SECUNIABroken Link
sunsolve.sun.com/search/document.do?assetkey=1-26-102846-1Vendor AdvisoryX Refsource SUNALERTBroken Link
www.us-cert.gov/cas/techalerts/TA06-354A.htmlThird Party AdvisoryX Refsource CERTBroken LinkUS Government Resource
secunia.com/advisories/23589Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2007/dsa-1253Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.debian.org/security/2007/dsa-1258Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.novell.com/linux/security/advisories/2007_06_mozilla.htmlVendor AdvisoryX Refsource SUSEBroken Link
secunia.com/advisories/23988Third Party AdvisoryX Refsource SECUNIABroken Link
security.gentoo.org/glsa/glsa-200701-02.xmlVendor AdvisoryX Refsource GENTOOBroken LinkThird Party Advisory
www.ubuntu.com/usn/usn-400-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
security-tracker.debian.org/tracker/CVE-2006-6499Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities