CVE-2006-6504 Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document,...
HighCVSS 9.3
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | >= 1.5, < 1.5.0.9 | 1.5.0.9 |
| mozilla Firefox | >= 2.0, < 2.0.0.1 | 2.0.0.1 |
| mozilla seamonkey | < 1.0.7 | 1.0.7 |
| Canonical Ubuntu Linux | = 5.10 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 6.10 | No fix listed |
| debian/firefox-esr(Debian:12) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.0esr-1 | 45.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.0esr-1 | 45.0esr-1 |
References
- FEDORA-2006-1491 broken-link vendor-advisory
- FEDORA-2007-004 broken-link vendor-advisory
- HPSBUX02153 broken-link vendor-advisory
- RHSA-2006:0758 third-party-advisory vendor-advisory
- RHSA-2006:0759 third-party-advisory vendor-advisory
- RHSA-2006:0760 third-party-advisory vendor-advisory
- 23282 third-party-advisory
- 23422 third-party-advisory
- 23433 third-party-advisory
- 23439 third-party-advisory
- 23440 third-party-advisory
- 23468 third-party-advisory
- 23514 third-party-advisory
- 23545 third-party-advisory
- 23589 third-party-advisory
- 23601 third-party-advisory
- 23614 third-party-advisory
- 23618 third-party-advisory
- 23672 third-party-advisory
- 23692 third-party-advisory
- GLSA-200701-02 third-party-advisory vendor-advisory
- 1017417 third-party-advisory vdb-entry
- 1017418 third-party-advisory vdb-entry
- GLSA-200701-04 third-party-advisory vendor-advisory
- VU#928956 third-party-advisory us-government-resource
- MDKSA-2007:010 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- SUSE-SA:2006:080 broken-link vendor-advisory
- SUSE-SA:2007:006 broken-link vendor-advisory
- 20061220 ZDI-06-051: Mozilla Firefox SVG Processing Remote Code Execution Vulnerability mailing-list
- 20061222 rPSA-2006-0234-1 firefox mailing-list
- 20070102 rPSA-2006-0234-2 firefox thunderbird mailing-list
- 21668 third-party-advisory vdb-entry
- USN-398-1 third-party-advisory vendor-advisory
- USN-398-2 third-party-advisory vendor-advisory
- TA06-354A third-party-advisory us-government-resource
- ADV-2006-5068 third-party-advisory vdb-entry
- ADV-2008-0083 third-party-advisory vdb-entry
- www.zerodayinitiative.com third-party-advisory vdb-entry
- issues.rpath.com broken-link
- oval:org.mitre.oval:def:11077 signature third-party-advisory vdb-entry
- Debian Security Tracker CVE-2006-6504 vendor-advisory