CVE-2006-4253 Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events t...
HighCVSS 7.6
EPSS 15.2%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads to a concurrency failure that causes structures to be freed incorrectly, as demonstrated by (1) ffoxdie and (2) ffoxdie3. NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie. Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability. NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| k-meleon project k-meleon | = 1.0.1 | No fix listed |
| mozilla Firefox | = 0.8 | No fix listed |
| mozilla Firefox | = 0.9 | No fix listed |
| mozilla Firefox | = 0.9-rc | No fix listed |
| mozilla Firefox | = 0.9.1 | No fix listed |
| mozilla Firefox | = 0.9.2 | No fix listed |
| mozilla Firefox | = 0.9.3 | No fix listed |
| mozilla Firefox | = 0.10 | No fix listed |
| mozilla Firefox | = 0.10.1 | No fix listed |
| mozilla Firefox | = 1.0 | No fix listed |
| mozilla Firefox | = 1.0.1 | No fix listed |
| mozilla Firefox | = 1.0.2 | No fix listed |
| mozilla Firefox | = 1.0.3 | No fix listed |
| mozilla Firefox | = 1.0.4 | No fix listed |
| mozilla Firefox | = 1.0.5 | No fix listed |
| mozilla Firefox | = 1.0.6 | No fix listed |
| mozilla Firefox | = 1.0.7 | No fix listed |
| mozilla Firefox | = 1.0.8 | No fix listed |
| mozilla Firefox | = 1.5 | No fix listed |
| mozilla Firefox | = 1.5-beta1 | No fix listed |
| mozilla Firefox | = 1.5-beta2 | No fix listed |
| mozilla Firefox | = 1.5.0.1 | No fix listed |
| mozilla Firefox | = 1.5.0.2 | No fix listed |
| mozilla Firefox | = 1.5.0.3 | No fix listed |
| mozilla Firefox | = 1.5.0.4 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | = 1.5.0.5 | No fix listed |
| mozilla Firefox | = 1.5.0.6 | No fix listed |
| netscape navigator | = 8.1 | No fix listed |
| debian/thunderbird(Debian:12) | < 1.5.0.7-1 | 1.5.0.7-1 |
| debian/thunderbird(Debian:13) | < 1.5.0.7-1 | 1.5.0.7-1 |
| debian/thunderbird(Debian:14) | < 1.5.0.7-1 | 1.5.0.7-1 |
References
- Debian Security Tracker CVE-2006-4253 vendor-advisory
- lcamtuf.coredump.cx
- lcamtuf.coredump.cx
- 21513 third-party-advisory vendor-advisory
- 21906 third-party-advisory vendor-advisory
- 21915 third-party-advisory vendor-advisory
- 21916 third-party-advisory vendor-advisory
- 21939 third-party-advisory vendor-advisory
- 21940 third-party-advisory vendor-advisory
- 21949 third-party-advisory vendor-advisory
- 21950 third-party-advisory vendor-advisory
- 22001 third-party-advisory vendor-advisory
- 22025 third-party-advisory vendor-advisory
- 22036 third-party-advisory vendor-advisory
- 22055 third-party-advisory vendor-advisory
- 22056 third-party-advisory
- 22066 third-party-advisory
- 22074 third-party-advisory vendor-advisory
- 22088 third-party-advisory vendor-advisory
- 22195 third-party-advisory
- 22210 third-party-advisory vendor-advisory
- 22274 third-party-advisory vendor-advisory
- 22391 third-party-advisory vendor-advisory
- 22422 third-party-advisory vendor-advisory
- 24711 third-party-advisory
- GLSA-200609-19 vendor-advisory
- GLSA-200610-01 vendor-advisory
- GLSA-200610-04 vendor-advisory
- 1016846 vdb-entry
- 1016847 vdb-entry
- 1016848 vdb-entry
- support.avaya.com
- MDKSA-2006:168 vendor-advisory
- MDKSA-2006:169 vendor-advisory
- www.mozilla.org
- SUSE-SA:2006:054 vendor-advisory
- www.pianetapc.it url-repurposed
- RHSA-2006:0675 vendor-advisory
- RHSA-2006:0676 vendor-advisory
- RHSA-2006:0677 vendor-advisory
- www.securiteam.com
- 20060812 Concurrency-related vulnerabilities in browsers - expect problems mailing-list
- 20060815 Re: Concurrency-related vulnerabilities in browsers - expect problems mailing-list
- 20060817 Re: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems mailing-list
- 20060817 RE: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problems mailing-list
- 20060915 rPSA-2006-0169-1 firefox thunderbird mailing-list
- 20061006 Re: Concurrency-related vulnerabilities in browsers - expect problems mailing-list
- 20061005 Re: Concurrency-related vulnerabilities in browsers - expect problems mailing-list
- 20061017 Flaw in Firefox 2.0 RC2 mailing-list
- 20061017 Re: Flaw in Firefox 2.0 RC2 mailing-list
- 20061019 Re: Flaw in Firefox 2.0 RC2 mailing-list
- 20061023 Flaw in Firefox 2.0 Final mailing-list
- 20061025 Mozilla Firefox JavaScript Handler Race Condition Memory Corruption Vulnerability mailing-list
- 19488 vdb-entry
- 19534 vdb-entry
- USN-350-1 vendor-advisory
- USN-351-1 vendor-advisory
- USN-352-1 vendor-advisory
- USN-354-1 vendor-advisory
- ADV-2006-3617 vdb-entry
- ADV-2006-3748 vdb-entry
- ADV-2007-1198 vdb-entry
- ADV-2008-0083 vdb-entry
- SSRT061181 vendor-advisory
- bugzilla.mozilla.org
- issues.rpath.com
- oval:org.mitre.oval:def:9528 signature vdb-entry