CVE-2006-0884

Thunderbird < 1.0.7 - Information Disclosure via IFRAME SRC JavaScript URI

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2006-0884. PoCs published by Georgi Guninski.

AI-analyzed exploit summary This exploit demonstrates a script-execution vulnerability in Mozilla products (Thunderbird, SeaMonkey, Mozilla Suite) where malicious JavaScript in an IFRAME can execute even if JavaScript is disabled. The PoC includes examples for both arbitrary script execution and a denial-of-service (application crash).

Description

The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Georgi Guninski · htmldoslinux
https://www.exploit-db.com/exploits/27257

This exploit demonstrates a script-execution vulnerability in Mozilla products (Thunderbird, SeaMonkey, Mozilla Suite) where malicious JavaScript in an IFRAME can execute even if JavaScript is disabled. The PoC includes examples for both arbitrary script execution and a denial-of-service (application crash).

Classification
Working Poc 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Mozilla Thunderbird (<1.5.0.2, <1.0.8), Mozilla SeaMonkey (<1.0.1), Mozilla Suite (<1.7.13)
No auth needed
Prerequisites: Victim must open a specially crafted email and attempt to reply
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (41)

Core 41
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3749
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/23653
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/425786/100/0/threaded
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2006-0330.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2024
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19902
Vendor Advisory vendor-advisory x_refsource_sgi
ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/276-1/
Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp
http://www.securityfocus.com/archive/1/438730/100/0/threaded
Exploit vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1015665
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19941
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19821
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:052
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21622
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19823
Patch vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1051
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2006-0329.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19811
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21033
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10782
Various Sources vendor-advisory x_refsource_suse
http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp
http://www.securityfocus.com/archive/1/446657/100/200/threaded
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:078
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20051
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19863
Exploit, Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/16770
Various Sources vendor-advisory x_refsource_sco
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt
Third Party Advisory, VDB Entry vendor-advisory x_refsource_fedora
http://www.securityfocus.com/archive/1/436296/100/0/threaded
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19721
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_04_25.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22065
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/19950
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/25983
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:076
Patch vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1046

Scores

EPSS 0.0707
EPSS Percentile 93.4%

Details

CWE
CWE-20
Status published
Products (18)
mozilla/thunderbird 0.1
mozilla/thunderbird 0.2
mozilla/thunderbird 0.3
mozilla/thunderbird 0.4
mozilla/thunderbird 0.5
mozilla/thunderbird 0.6
mozilla/thunderbird 0.7
mozilla/thunderbird 0.7.1
mozilla/thunderbird 0.7.2
mozilla/thunderbird 0.7.3
... and 8 more
Published Feb 24, 2006
Tracked Since Feb 18, 2026