CVE-2006-6504: canonical ubuntu_linux Code Injection

CVSS: 9.3v2.0HighModified

AliasesDEBIAN-CVE-2006-6504

Published 20-12-2006Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2006-6504 is a high (CVSS 9.3) Code Injection vulnerability in canonical ubuntu_linux. EPSS estimates a 8.89% chance of exploitation in the next 30 days, higher than 95.1% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

8.89%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3

RHSA-2006:0758 RHSA-2006:0759 RHSA-2006:0760

Timeline

20-12-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

8.89%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 8.89% on 19-09-2026

19-09-202619-10-2026

EPSS score

8.89%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Mozilla2 products

firefox≥ 1.5, < 1.5.0.9 | ≥ 2.0, < 2.0.0.1
seamonkey< 1.0.7

Canonical1 product

ubuntu_linuxEOL5.10 | 6.06 | 6.10

Debian1 product

firefox-esr< 45.0esr-1

3 vendors · 4 products

References

42 links

www.securityfocus.com/bid/21668VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/23433Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:010Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/23439Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/23672Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2006/5068VDB EntryX Refsource VUPENThird Party Advisory
secunia.com/advisories/23468Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2006-0758.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
securitytracker.com/id?1017417VDB EntryX Refsource SECTRACKThird Party Advisory
secunia.com/advisories/23692Third Party AdvisoryX Refsource SECUNIA

Show all 42 references

www.ubuntu.com/usn/usn-398-2Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.gentoo.org/security/en/glsa/glsa-200701-04.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
secunia.com/advisories/23282Third Party AdvisoryX Refsource SECUNIA
fedoranews.org/cms/node/2297Vendor AdvisoryX Refsource FEDORABroken Link
secunia.com/advisories/23422Third Party AdvisoryX Refsource SECUNIA
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Vendor AdvisoryX Refsource HPBroken Link
www.mozilla.org/security/announce/2006/mfsa2006-73.htmlX Refsource CONFIRMVendor Advisory
secunia.com/advisories/23614Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2006-0759.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11077VDB EntrySignatureX Refsource OVALThird Party Advisory
www.ubuntu.com/usn/usn-398-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.zerodayinitiative.com/advisories/ZDI-06-051.htmlX Refsource MISCThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2008/0083VDB EntryX Refsource VUPENThird Party Advisory
fedoranews.org/cms/node/2338Vendor AdvisoryX Refsource FEDORABroken Link
secunia.com/advisories/23440Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2006_80_mozilla.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.securityfocus.com/archive/1/455145/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/23545Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/23618Third Party AdvisoryX Refsource SECUNIA
securitytracker.com/id?1017418VDB EntryX Refsource SECTRACKThird Party Advisory
www.us-cert.gov/cas/techalerts/TA06-354A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.securityfocus.com/archive/1/454939/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/23589Third Party AdvisoryX Refsource SECUNIA
www.kb.cert.org/vuls/id/928956Third Party AdvisoryX Refsource CERT VNUS Government Resource
issues.rpath.com/browse/RPL-883X Refsource CONFIRMBroken Link
www.securityfocus.com/archive/1/455728/100/200/threadedMailing ListX Refsource BUGTRAQ
www.novell.com/linux/security/advisories/2007_06_mozilla.htmlVendor AdvisoryX Refsource SUSEBroken Link
secunia.com/advisories/23601Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/23514Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200701-02.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
rhn.redhat.com/errata/RHSA-2006-0760.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security-tracker.debian.org/tracker/CVE-2006-6504Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities