CVE-2006-2775

Mozilla Firefox and Thunderbird < 1.5.0.4 - URL Restriction Bypass via XUL Attribute Association

Title source: llm
STIX 2.1

Description

Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.

References (42)

Core 42
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20709
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21176
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3748
Patch, Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2006/mfsa2006-35.html
Patch, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA06-153A.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21210
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016214
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/435795/100/0/threaded
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3749
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21178
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1016202
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21607
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21532
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0083
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:145
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/297-3/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/296-1/
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/323-1/
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20561
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20382
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20376
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:146
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/18228
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21188
Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp
http://www.securityfocus.com/archive/1/446658/100/200/threaded
Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp
http://www.securityfocus.com/archive/1/446657/100/200/threaded
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/296-2/
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200606-21.xml
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1118
Patch, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/243153
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1120
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2006/dsa-1134
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200606-12.xml
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21324
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21183
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22066
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2006_35_mozilla.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/297-1/
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26846
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2106
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2006:143
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22065

Scores

EPSS 0.0457
EPSS Percentile 90.6%

Details

CWE
CWE-264
Status published
Products (41)
mozilla/firefox 0.8
mozilla/firefox 0.9 (2 CPE variants)
mozilla/firefox 0.9.1
mozilla/firefox 0.9.2
mozilla/firefox 0.9.3
mozilla/firefox 0.10
mozilla/firefox 0.10.1
mozilla/firefox 1.0
mozilla/firefox 1.0.1
mozilla/firefox 1.0.2
... and 31 more
Published Jun 02, 2006
Tracked Since Feb 18, 2026