CVSS: 9.8EPSS: 29%CPEs: 9EXPL: 0CVE-2006-1728 – Debian Linux Security Advisory 1051-1
https://notcve.org/view.php?id=CVE-2006-1728
14 Apr 2006 — Unspecified vulnerability in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to the crypto.generateCRMFRequest method. Several security related problems have been discovered in Mozilla Thunderbird. This advisory addresses those issues. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2006-1729 – Debian Linux Security Advisory 1051-1
https://notcve.org/view.php?id=CVE-2006-1729
14 Apr 2006 — Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler. Several security related problems have been discovered in Mozilla Thunderbird. This advisory addresses those issues. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 26%CPEs: 32EXPL: 0CVE-2006-1730 – Mozilla Firefox CSS Letter-Spacing Heap Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2006-1730
14 Apr 2006 — Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via a large number in the CSS letter-spacing property that leads to a heap-based buffer overflow. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of the Mozilla/Firefox web browser and Thunderbird e-mail client. User interaction is required to exploit this vulnerabilit... • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-189: Numeric Errors •
CVSS: 6.1EPSS: 2%CPEs: 30EXPL: 0CVE-2006-1731 – Ubuntu Security Notice 276-1
https://notcve.org/view.php?id=CVE-2006-1731
14 Apr 2006 — Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks. A large number of mozilla-thunderbird related vulnerabilities have been patched for Ubuntu. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 24%CPEs: 30EXPL: 0CVE-2006-1733 – Ubuntu Security Notice 276-1
https://notcve.org/view.php?id=CVE-2006-1733
14 Apr 2006 — Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain." A large number of mozilla-thunderbird related vulnerabilities have been patched for Ubuntu. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 32%CPEs: 30EXPL: 1CVE-2006-1734 – Ubuntu Security Notice 276-1
https://notcve.org/view.php?id=CVE-2006-1734
14 Apr 2006 — Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using the Object.watch method to access the "clone parent" internal function. A large number of mozilla-thunderbird related vulnerabilities have been patched for Ubuntu. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt •
CVSS: 9.8EPSS: 39%CPEs: 30EXPL: 1CVE-2006-1735 – Ubuntu Security Notice 276-1
https://notcve.org/view.php?id=CVE-2006-1735
14 Apr 2006 — Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges. A large number of mozilla-thunderbird related vulnerabilities have been patched for Ubuntu. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 33%CPEs: 30EXPL: 0CVE-2006-1739 – Ubuntu Security Notice 276-1
https://notcve.org/view.php?id=CVE-2006-1739
14 Apr 2006 — The CSS border-rendering code in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain Cascading Style Sheets (CSS) that causes an out-of-bounds array write and buffer overflow. A large number of mozilla-thunderbird related vulnerabilities have been patched for Ubuntu. • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 1%CPEs: 7EXPL: 1CVE-2006-1741 – Ubuntu Security Notice 276-1
https://notcve.org/view.php?id=CVE-2006-1741
14 Apr 2006 — Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection". A large number of mozilla-thunderbird related vulnerabilities have been patched f... • ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 29%CPEs: 11EXPL: 1CVE-2005-4134 – Mozilla Firefox 0.x/1.x - Large History File Buffer Overflow
https://notcve.org/view.php?id=CVE-2005-4134
09 Dec 2005 — Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote attackers to cause a denial of service (CPU consumption and delayed application startup) via a web site with a large title, which is recorded in history.dat but not processed efficiently during startup. NOTE: despite initial reports, the Mozilla vendor does not believe that this issue can be used to trigger a crash or buffer overflow in Firefox. Also, it has been independently reported that Netscape 8.1 does not have this ... • https://www.exploit-db.com/exploits/26762 •