CVE-2006-1741
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page…
Does this matter?
Lower severity and a low EPSS score (3.89%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to inject arbitrary Javascript into other sites by (1) "using a modal alert to suspend an event handler while a new page is being loaded", (2) using eval(), and using certain variants involving (3) "new Script;" and (4) using window.__proto__ to extend eval, aka "cross-site JavaScript injection".
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 3.89% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mozilla/firefox · mozilla/mozilla suite · mozilla/seamonkey · canonical/ubuntu linux
- Source
- secalert@redhat.com
References
- ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txtBroken Link
- ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.ascBroken Link
- http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.htmlBroken Link
- http://secunia.com/advisories/19631Third Party Advisory
- http://secunia.com/advisories/19696Third Party Advisory
- http://secunia.com/advisories/19714Third Party Advisory
- http://secunia.com/advisories/19721Third Party Advisory
- http://secunia.com/advisories/19729Third Party Advisory
- http://secunia.com/advisories/19746Third Party Advisory
- http://secunia.com/advisories/19759Third Party Advisory
- http://secunia.com/advisories/19780Third Party Advisory
- http://secunia.com/advisories/19811Third Party Advisory
- http://secunia.com/advisories/19821Third Party Advisory
- http://secunia.com/advisories/19823Third Party Advisory
- http://secunia.com/advisories/19852Third Party Advisory
- http://secunia.com/advisories/19862Third Party Advisory
- http://secunia.com/advisories/19863Third Party Advisory
- http://secunia.com/advisories/19902Third Party Advisory
- http://secunia.com/advisories/19941Third Party Advisory
- http://secunia.com/advisories/19950Third Party Advisory
- http://secunia.com/advisories/20051Third Party Advisory
- http://secunia.com/advisories/21033Third Party Advisory
- http://secunia.com/advisories/21622Third Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1Broken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1Broken Link
- http://support.avaya.com/elmodocs2/security/ASA-2006-205.htmThird Party Advisory
- http://www.debian.org/security/2006/dsa-1044Third Party Advisory
- http://www.debian.org/security/2006/dsa-1046Third Party Advisory
- http://www.debian.org/security/2006/dsa-1051Third Party Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200604-12.xmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.