CVE-2006-2786

Mozilla Firefox & Thunderbird <1.5.0.4 - SSRF

Title source: llm

Description

HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via (1) invalid HTTP response headers with spaces between the header name and the colon, which might not be ignored in some cases, or (2) HTTP 1.1 headers through an HTTP 1.0 proxy, which are ignored by the proxy but processed by the client.

References (47)

Core 47

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/26844

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9966

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/18228

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0594.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0610.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20709

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21176

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:145

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/3748

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/296-1/

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/323-1/

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20561

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21336

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20382

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1016214

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/435795/100/0/threaded

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/3749

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/20376

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2006-0609.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21178

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1016202

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21532

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21270

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/0083

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21188

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21134

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21631

Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp

http://www.securityfocus.com/archive/1/446658/100/200/threaded

Third Party Advisory, VDB Entry vendor-advisory x_refsource_hp

http://www.securityfocus.com/archive/1/446657/100/200/threaded

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/296-2/

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200606-21.xml

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1118

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1120

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0611.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2006/dsa-1134

Third Party Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200606-12.xml

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21324

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21183

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/22066

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21269

Vendor Advisory vendor-advisory x_refsource_suse

http://www.novell.com/linux/security/advisories/2006_35_mozilla.html

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2006/mfsa2006-33.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/297-1/

Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2006-0578.html

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/2106

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:143

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/22065

Scores

EPSS 0.0177

EPSS Percentile 75.6%

Details

Status published

Products (2)

mozilla/firefox < 1.5.0.3

mozilla/thunderbird < 1.5.0.3

Published Jun 02, 2006

Tracked Since Feb 18, 2026