CVE Feed

Dashboard / CVE / CVE-2006-2779

CVE-2006-2779

Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) nested <option> tags in a select tag, (2) a DOMNodeRemoved mutation event, (3) "Content-implemented tree views," (4) BoxObjects, (5) the XBL implementation, (6) an iframe that attempts to remove itself, which leads to memory corruption.

Published:Jun 2, 2006

Last Modified:Apr 16, 2026

EPS:Jun 2, 2006

EPSS Score:0.23286

CVSS Score:9.3

Affected Products

Vendor

Product

Action

Vendor

Mozilla

Product

Firefox

Mozilla

Firefox

Vendor

Mozilla

Product

Thunderbird

Mozilla

Thunderbird

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Exploits

No exploit reference

Common Weakness Enumeration

CWE-94 Improper Control of Generation of Code ('Code Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-242 Code Injection

CAPEC-35 Leverage Executable Code in Non-Executable Files

CAPEC-77 Manipulating User-Controlled Variables

Related CVEs

CVE-2026-84144 (CVSS 7.5) — Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence…

CVE-2026-84143 (CVSS 9.8) — Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of th…

CVE-2026-84142 (CVSS 9.8) — Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or a…

CVE-2026-84141 (CVSS 9.8) — Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR…

CVE-2026-84140 (CVSS 9.8) — Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ES…

CVE-2026-84139 (CVSS 6.1) — Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.…

CVE-2026-84138 (CVSS 6.5) — Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155…

CVE-2026-84137 (CVSS 4.3) — Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153…

CVE-2026-84136 (CVSS 6.1) — Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, …

CVE-2026-84135 (CVSS 9.8) — Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.…

References

http://rhn.redhat.com/errata/RHSA-2006-0609.html

http://secunia.com/advisories/20376

http://secunia.com/advisories/20382

http://secunia.com/advisories/20561

http://secunia.com/advisories/20709

http://secunia.com/advisories/21134

http://secunia.com/advisories/21176

http://secunia.com/advisories/21178

http://secunia.com/advisories/21183

http://secunia.com/advisories/21188

http://secunia.com/advisories/21210

http://secunia.com/advisories/21269

http://secunia.com/advisories/21270

http://secunia.com/advisories/21324

http://secunia.com/advisories/21336

http://secunia.com/advisories/21532

http://secunia.com/advisories/21607

http://secunia.com/advisories/21631

http://secunia.com/advisories/21634

http://secunia.com/advisories/21654

http://secunia.com/advisories/22065

http://secunia.com/advisories/22066

http://secunia.com/advisories/27216

http://securitytracker.com/id?1016202

http://securitytracker.com/id?1016214

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102943-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200387-1

http://www.debian.org/security/2006/dsa-1118

http://www.debian.org/security/2006/dsa-1120

http://www.debian.org/security/2006/dsa-1134

http://www.debian.org/security/2006/dsa-1159

http://www.debian.org/security/2006/dsa-1160

http://www.gentoo.org/security/en/glsa/glsa-200606-12.xml

http://www.gentoo.org/security/en/glsa/glsa-200606-21.xml

http://www.kb.cert.org/vuls/id/466673

http://www.mandriva.com/security/advisories?name=MDKSA-2006:143

http://www.mandriva.com/security/advisories?name=MDKSA-2006:145

http://www.mandriva.com/security/advisories?name=MDKSA-2006:146

http://www.mozilla.org/security/announce/2006/mfsa2006-32.html

http://www.novell.com/linux/security/advisories/2006_35_mozilla.html

http://www.redhat.com/support/errata/RHSA-2006-0578.html

http://www.redhat.com/support/errata/RHSA-2006-0594.html

http://www.redhat.com/support/errata/RHSA-2006-0610.html

http://www.redhat.com/support/errata/RHSA-2006-0611.html

http://www.securityfocus.com/archive/1/435795/100/0/threaded

http://www.securityfocus.com/archive/1/446657/100/200/threaded

http://www.securityfocus.com/archive/1/446658/100/200/threaded

http://www.securityfocus.com/bid/18228

http://www.us-cert.gov/cas/techalerts/TA06-153A.html

http://www.vupen.com/english/advisories/2006/2106

http://www.vupen.com/english/advisories/2006/3748

http://www.vupen.com/english/advisories/2006/3749

http://www.vupen.com/english/advisories/2007/3488

http://www.vupen.com/english/advisories/2008/0083

https://exchange.xforce.ibmcloud.com/vulnerabilities/26843

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9762

https://usn.ubuntu.com/296-1/

https://usn.ubuntu.com/296-2/

https://usn.ubuntu.com/297-1/

https://usn.ubuntu.com/297-3/

https://usn.ubuntu.com/323-1/

http://rhn.redhat.com/errata/RHSA-2006-0609.html

http://secunia.com/advisories/20376

http://secunia.com/advisories/20382

http://secunia.com/advisories/20561

http://secunia.com/advisories/20709

http://secunia.com/advisories/21134

http://secunia.com/advisories/21176

http://secunia.com/advisories/21178

http://secunia.com/advisories/21183

http://secunia.com/advisories/21188

http://secunia.com/advisories/21210

http://secunia.com/advisories/21269

http://secunia.com/advisories/21270

http://secunia.com/advisories/21324

http://secunia.com/advisories/21336

http://secunia.com/advisories/21532

http://secunia.com/advisories/21607

http://secunia.com/advisories/21631

http://secunia.com/advisories/21634

http://secunia.com/advisories/21654

http://secunia.com/advisories/22065

http://secunia.com/advisories/22066

http://secunia.com/advisories/27216

http://securitytracker.com/id?1016202

http://securitytracker.com/id?1016214

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102943-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200387-1

http://www.debian.org/security/2006/dsa-1118

http://www.debian.org/security/2006/dsa-1120

http://www.debian.org/security/2006/dsa-1134

http://www.debian.org/security/2006/dsa-1159

http://www.debian.org/security/2006/dsa-1160

http://www.gentoo.org/security/en/glsa/glsa-200606-12.xml

http://www.gentoo.org/security/en/glsa/glsa-200606-21.xml

http://www.kb.cert.org/vuls/id/466673

http://www.mandriva.com/security/advisories?name=MDKSA-2006:143

http://www.mandriva.com/security/advisories?name=MDKSA-2006:145

http://www.mandriva.com/security/advisories?name=MDKSA-2006:146

http://www.mozilla.org/security/announce/2006/mfsa2006-32.html

http://www.novell.com/linux/security/advisories/2006_35_mozilla.html

http://www.redhat.com/support/errata/RHSA-2006-0578.html

http://www.redhat.com/support/errata/RHSA-2006-0594.html

http://www.redhat.com/support/errata/RHSA-2006-0610.html

http://www.redhat.com/support/errata/RHSA-2006-0611.html

http://www.securityfocus.com/archive/1/435795/100/0/threaded

http://www.securityfocus.com/archive/1/446657/100/200/threaded

http://www.securityfocus.com/archive/1/446658/100/200/threaded

http://www.securityfocus.com/bid/18228

http://www.us-cert.gov/cas/techalerts/TA06-153A.html

http://www.vupen.com/english/advisories/2006/2106

http://www.vupen.com/english/advisories/2006/3748

http://www.vupen.com/english/advisories/2006/3749

http://www.vupen.com/english/advisories/2007/3488

http://www.vupen.com/english/advisories/2008/0083

https://exchange.xforce.ibmcloud.com/vulnerabilities/26843

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9762

https://usn.ubuntu.com/296-1/

https://usn.ubuntu.com/296-2/

https://usn.ubuntu.com/297-1/

https://usn.ubuntu.com/297-3/

https://usn.ubuntu.com/323-1/

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High