CVSS: 6.4EPSS: 38%CPEs: 28EXPL: 0CVE-2006-5462
https://notcve.org/view.php?id=CVE-2006-5462
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340. La biblioteca Mozilla Network Security Service (NSS) en versiones anteriores a la 3.11.3, como el usado en el Mozilla Firefox en versiones anteriores a la 1.5.0.8, en el Thunderbird anterior a la versión 1.5.0.8 y en el SeaMonkey anteriores a la versión 1.0.6, cuando utiliza una clave RSA con exponente 3, no gestiona apropiadamente datos extra en la firma, lo cual permiten a atacantes remotos falsificar firmas para los certificados de correo electrónico SSL/TLS. NOTA: este identificador es para versiones de productos no parchados, que inicialmente se vieron en el CVE-2006-4340. • ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P http://rhn.redhat.com/errata/RHSA-2006-0733.html http://rhn.redhat.com/errata/RHSA-2006-0734.html http://rhn.redhat.com/errata/RHSA-2006-0735.html http://secunia.com/advisories/22066 http://secunia.com/advisories/22722 http://secunia.com/advisories/22727 http://secunia.com/advisories/22737 http://secunia.com/advisories/22763 http://secunia.com/advisories/22770 http://secunia.com/advisories/22815 http& •
CVSS: 5.0EPSS: 8%CPEs: 29EXPL: 0CVE-2006-5748 – seamonkey < 1.0.6 multiple vulnerabilities
https://notcve.org/view.php?id=CVE-2006-5748
Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger memory corruption. Múltiples vulnerabilidades sin especificar en el motor de JavaScript en el Mozilla Firefox anterior al 1.5.0.8, en el Thunderbird anterior al 1.5.0.8 y en el SeaMonkey anterior al 1.0.6 permiten a atacantes remotos provocar una denegación de servicio (caída) y la posibilidad de ejecutar código de su elección a través de vectores sin especificar que disparan una corrupción de memoria. • ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P http://rhn.redhat.com/errata/RHSA-2006-0733.html http://rhn.redhat.com/errata/RHSA-2006-0734.html http://rhn.redhat.com/errata/RHSA-2006-0735.html http://secunia.com/advisories/22066 http://secunia.com/advisories/22722 http://secunia.com/advisories/22727 http://secunia.com/advisories/22737 http://secunia.com/advisories/22763 http://secunia.com/advisories/22770 http://secunia.com/advisories/22774 http& •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2006-5783
https://notcve.org/view.php?id=CVE-2006-5783
Firefox 1.5.0.7 on Kubuntu Linux allows remote attackers to cause a denial of service (crash) via a long URL in an A tag. NOTE: this issue has been disputed by several vendors, who could not reproduce the report. In addition, the scope of the impact - system freeze - suggests an issue that is not related to Firefox. Due to this impact, CVE concurs with the dispute ** IMPUGNADO ** Firefox 1.5.0.7 en Kubuntu Linux permite a atacantes remotos provocar una denegación de servicio (caída) mediante una URL larga en una etiqueta A. NOTA: este asunto ha sido impugnado por varios fabricantes, que no pudieron reproducir el informe. • http://www.securityfocus.com/archive/1/450398/100/0/threaded http://www.securityfocus.com/archive/1/450424/100/0/threaded http://www.securityfocus.com/archive/1/450476/100/0/threaded http://www.securityfocus.com/archive/1/450730/100/0/threaded •
CVSS: 5.0EPSS: 40%CPEs: 3EXPL: 6CVE-2006-5633 – Mozilla Firefox 1.5.0.7/2.0 - 'createRange' Remote Denial of Service
https://notcve.org/view.php?id=CVE-2006-5633
Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b, allows remote attackers to cause a denial of service (crash) by creating a range object using createRange, calling selectNode on a DocType node (DOCUMENT_TYPE_NODE), then calling createContextualFragment on the range, which triggers a null dereference. NOTE: the original Bugtraq post mentioned that code execution was possible, but followup analysis has shown that it is only a null dereference. Firefox 1.5.0.7 y 2.0, y Seamonkey 1.1b, permite a atacantes remotos provocar una denegación de servicio (caída) creando un objeto rango usando createRange, llamando a selectNode en un nodo DocType (DOCUMENT_TYPE_NODE), y después llamando a createContextualFragment en el rango, lo cual dispara una referencia nula. NOTA: el post original en Bugtraq mencionaba que la ejecución de código era posible, pero análisis posteriores han mostrado que es sólo una referencia nula. • https://www.exploit-db.com/exploits/2695 http://lists.grok.org.uk/pipermail/full-disclosure/2006-October/050416.html http://www.gotfault.net/research/advisory/gadv-firefox.txt http://www.securityfocus.com/archive/1/450155/100/0/threaded http://www.securityfocus.com/archive/1/450167/100/0/threaded http://www.securityfocus.com/archive/1/450168/100/0/threaded http://www.securityfocus.com/archive/1/450682/100/200/threaded http://www.securityfocus.com/archive/1/452803/100/0/ •
CVSS: 7.5EPSS: 46%CPEs: 30EXPL: 0CVE-2006-5159
https://notcve.org/view.php?id=CVE-2006-5159
Stack-based buffer overflow in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving JavaScript. NOTE: the vendor and original researchers have released a follow-up comment disputing the severity of this issue, in which the researcher states that "we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this... I have not succeeded in making this code do anything more than cause a crash and eat up system resources" ** IMPUGNADA ** Desbordamiento de búfer basado en pila en Mozilla Firefox permite a atacantes remotos ejecutar código de su elección mediante vectores no especificados implicando JavaScript. NOTA: el vendedor e investigadores originales han liberado un comentario de continuación impugnando la severidad de este asunto, en el cual el investigador afirma que "hemos mencionado que hubo una vulnerabilidad en Firefox previamente conocida que podría provocar un desbordamiento de pila permitiendo ejecución remota de código. • http://developer.mozilla.org/devnews/index.php/2006/10/02/update-possible-vulnerability-reported-at-toorcon http://securityreason.com/securityalert/1678 http://securitytracker.com/id?1016962 http://www.securityfocus.com/archive/1/447493/100/0/threaded http://www.securityfocus.com/archive/1/447497/100/0/threaded http://www.securityfocus.com/bid/20282 http://www.securityfocus.com/bid/20294 http://www.securitypronews.com/insiderreports/insider/spn-49-20061003FirefoxVulnerabilityClaimWasAJoke.html https:// •