CVE-2006-6499
The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to…
Does this matter?
Lower severity and a low EPSS score (3.84%). Track it; it rarely justifies an emergency change on its own.
Description
The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 overwrites memory instead of exiting when the floating point precision is reduced, which allows remote attackers to cause a denial of service via any plugins that reduce the precision.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
- EPSS
- 3.84% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-835
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · debian/debian linux · canonical/ubuntu linux
- Source
- secalert@redhat.com
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Broken Link
- http://secunia.com/advisories/23282Broken Link, Third Party Advisory
- http://secunia.com/advisories/23420Broken Link, Third Party Advisory
- http://secunia.com/advisories/23422Broken Link, Third Party Advisory
- http://secunia.com/advisories/23545Broken Link, Third Party Advisory
- http://secunia.com/advisories/23589Broken Link, Third Party Advisory
- http://secunia.com/advisories/23591Broken Link, Third Party Advisory
- http://secunia.com/advisories/23614Broken Link, Third Party Advisory
- http://secunia.com/advisories/23672Broken Link, Third Party Advisory
- http://secunia.com/advisories/23692Broken Link, Third Party Advisory
- http://secunia.com/advisories/23988Broken Link, Third Party Advisory
- http://secunia.com/advisories/24078Broken Link, Third Party Advisory
- http://secunia.com/advisories/24390Broken Link, Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200701-02.xmlBroken Link, Third Party Advisory
- http://securitytracker.com/id?1017398Broken Link, Third Party Advisory, VDB Entry
- http://securitytracker.com/id?1017405Broken Link, Third Party Advisory, VDB Entry
- http://securitytracker.com/id?1017406Broken Link, Third Party Advisory, VDB Entry
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102846-1Broken Link
- http://www.debian.org/security/2007/dsa-1253Third Party Advisory
- http://www.debian.org/security/2007/dsa-1258Third Party Advisory
- http://www.debian.org/security/2007/dsa-1265Third Party Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200701-04.xmlThird Party Advisory
- http://www.kb.cert.org/vuls/id/427972Third Party Advisory, US Government Resource
- http://www.mozilla.org/security/announce/2006/mfsa2006-68.htmlVendor Advisory
- http://www.novell.com/linux/security/advisories/2006_80_mozilla.htmlBroken Link
- http://www.novell.com/linux/security/advisories/2007_06_mozilla.htmlBroken Link
- http://www.securityfocus.com/bid/21668Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-398-1Third Party Advisory
- http://www.ubuntu.com/usn/usn-398-2Third Party Advisory
- http://www.ubuntu.com/usn/usn-400-1Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.