// For flags

CVE-2006-6504

Mozilla Firefox SVG Processing Remote Code Execution Vulnerability

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.

Mozilla Firefox 2.x anterior a 2.0.0.1, 1.5.x anterior a 1.5.0.9, y SeaMonkey anterior a 1.0.7 permite a atacantes remotos ejecutar código de su elección añadiendo un nodo DOM con un comentario SVG a otro tipo de documento, lo cual desemboca en una corrupción de memoria.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.
The specific flaw exists in the browser's handling of SVG comment objects. Firefox does not correctly handle requests to append SVG comments to elements in other types of documents. Attempting such an operation results in a memory corruption that can be exploited to execute arbitrary code.

*Credits: Anonymous
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-12-13 CVE Reserved
  • 2006-12-19 CVE Published
  • 2023-10-23 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (44)
URL Tag Source
http://secunia.com/advisories/23282 Third Party Advisory
http://secunia.com/advisories/23422 Third Party Advisory
http://secunia.com/advisories/23433 Third Party Advisory
http://secunia.com/advisories/23439 Third Party Advisory
http://secunia.com/advisories/23440 Third Party Advisory
http://secunia.com/advisories/23468 Third Party Advisory
http://secunia.com/advisories/23514 Third Party Advisory
http://secunia.com/advisories/23545 Third Party Advisory
http://secunia.com/advisories/23589 Third Party Advisory
http://secunia.com/advisories/23601 Third Party Advisory
http://secunia.com/advisories/23614 Third Party Advisory
http://secunia.com/advisories/23618 Third Party Advisory
http://secunia.com/advisories/23672 Third Party Advisory
http://secunia.com/advisories/23692 Third Party Advisory
http://securitytracker.com/id?1017417 Third Party Advisory
http://securitytracker.com/id?1017418 Third Party Advisory
http://www.kb.cert.org/vuls/id/928956 Third Party Advisory
http://www.securityfocus.com/archive/1/454939/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/455145/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/455728/100/200/threaded Mailing List
http://www.securityfocus.com/bid/21668 Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA06-354A.html Third Party Advisory
http://www.vupen.com/english/advisories/2006/5068 Third Party Advisory
http://www.vupen.com/english/advisories/2008/0083 Third Party Advisory
http://www.zerodayinitiative.com/advisories/ZDI-06-051.html Third Party Advisory
https://issues.rpath.com/browse/RPL-883 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11077 Signature
URL Date SRC
URL Date SRC
URL Date SRC
ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.asc 2018-10-17
http://fedoranews.org/cms/node/2297 2018-10-17
http://fedoranews.org/cms/node/2338 2018-10-17
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 2018-10-17
http://rhn.redhat.com/errata/RHSA-2006-0758.html 2018-10-17
http://rhn.redhat.com/errata/RHSA-2006-0759.html 2018-10-17
http://rhn.redhat.com/errata/RHSA-2006-0760.html 2018-10-17
http://security.gentoo.org/glsa/glsa-200701-02.xml 2018-10-17
http://www.gentoo.org/security/en/glsa/glsa-200701-04.xml 2018-10-17
http://www.mandriva.com/security/advisories?name=MDKSA-2007:010 2018-10-17
http://www.mozilla.org/security/announce/2006/mfsa2006-73.html 2018-10-17
http://www.novell.com/linux/security/advisories/2006_80_mozilla.html 2018-10-17
http://www.novell.com/linux/security/advisories/2007_06_mozilla.html 2018-10-17
http://www.ubuntu.com/usn/usn-398-1 2018-10-17
http://www.ubuntu.com/usn/usn-398-2 2018-10-17
https://access.redhat.com/security/cve/CVE-2006-6504 2006-12-19
https://bugzilla.redhat.com/show_bug.cgi?id=1618248 2006-12-19
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mozilla
Search vendor "Mozilla"
 Firefox
Search vendor "Mozilla" for product "Firefox"
 >= 1.5 < 1.5.0.9
Search vendor "Mozilla" for product "Firefox" and version " >= 1.5 < 1.5.0.9"
-
Affected
Mozilla
Search vendor "Mozilla"
 Firefox
Search vendor "Mozilla" for product "Firefox"
 >= 2.0 < 2.0.0.1
Search vendor "Mozilla" for product "Firefox" and version " >= 2.0 < 2.0.0.1"
-
Affected
Mozilla
Search vendor "Mozilla"
 Seamonkey
Search vendor "Mozilla" for product "Seamonkey"
 < 1.0.7
Search vendor "Mozilla" for product "Seamonkey" and version " < 1.0.7"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 5.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "5.10"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 6.06
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"
lts
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 6.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.10"
-
Affected