CVE-2006-0296

Mozilla/Firefox <1.5.0.1/SeaMonkey <1.0 - XSS

Title source: llm

Description

The XULDocument.persist function in Mozilla, Firefox before 1.5.0.1, and SeaMonkey before 1.0 does not validate the attribute name, which allows remote attackers to execute arbitrary Javascript by injecting RDF data into the user's localstore.rdf file.

References (62)

Core 62

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0330.html

Vendor Advisory vendor-advisory x_refsource_fedora

http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00005.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/24434

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/592425

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:036

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/275-1/

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19902

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:037

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/276-1/

Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp

http://www.securityfocus.com/archive/1/438730/100/0/threaded

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19941

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19780

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19821

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21622

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19862

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19230

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18704

Vendor Advisory x_refsource_confirm

http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19823

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1051

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18709

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/3749

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/271-1/

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18705

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/16476

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/0413

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1015570

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19746

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21033

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=319847

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11803

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18700

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19759

Various Sources x_refsource_confirm

http://www.mozilla.org/security/announce/2006/mfsa2006-05.html

Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp

http://www.securityfocus.com/archive/1/446657/100/200/threaded

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0200.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18706

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1493

Vendor Advisory vendor-advisory x_refsource_fedora

http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00006.html

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:078

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0199.html

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA06-038A.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20051

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19863

Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora

http://www.securityfocus.com/archive/1/425978/100/0/threaded

Vendor Advisory vendor-advisory x_refsource_sgi

ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U

Various Sources vendor-advisory x_refsource_sco

ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18708

Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora

http://www.securityfocus.com/archive/1/425975/100/0/threaded

Vendor Advisory vendor-advisory x_refsource_sunalert

http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19852

Vendor Advisory vendor-advisory x_refsource_suse

http://www.novell.com/linux/security/advisories/2006_04_25.html

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/3391

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18703

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/22065

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/19950

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1046

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1044

Scores

EPSS 0.0404

EPSS Percentile 89.5%

Details

Status published

Products (17)

mozilla/firefox 0.8

mozilla/firefox 0.9 (2 CPE variants)

mozilla/firefox 0.9.1

mozilla/firefox 0.9.2

mozilla/firefox 0.9.3

mozilla/firefox 0.10

mozilla/firefox 0.10.1

mozilla/firefox 1.0

mozilla/firefox 1.0.1

mozilla/firefox 1.0.2

... and 7 more

Published Feb 02, 2006

Tracked Since Feb 18, 2026