VulnerabilityModified

CVE-2006-6503

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to bypass cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI.

MEDIUM 6.8EPSS 4.10%

Does this matter?

Lower severity and a low EPSS score (4.10%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 4.10% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-254
Affected: mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · debian/debian linux · canonical/ubuntu linux
Source: secalert@redhat.com

References

ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.ascBroken Link
http://fedoranews.org/cms/node/2297Broken Link
http://fedoranews.org/cms/node/2338Broken Link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Broken Link
http://rhn.redhat.com/errata/RHSA-2006-0758.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2006-0759.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2006-0760.htmlThird Party Advisory
http://secunia.com/advisories/23282Third Party Advisory
http://secunia.com/advisories/23420Third Party Advisory
http://secunia.com/advisories/23422Third Party Advisory
http://secunia.com/advisories/23433Third Party Advisory
http://secunia.com/advisories/23439Third Party Advisory
http://secunia.com/advisories/23440Third Party Advisory
http://secunia.com/advisories/23468Third Party Advisory
http://secunia.com/advisories/23514Third Party Advisory
http://secunia.com/advisories/23545Third Party Advisory
http://secunia.com/advisories/23589Third Party Advisory
http://secunia.com/advisories/23591Third Party Advisory
http://secunia.com/advisories/23598Third Party Advisory
http://secunia.com/advisories/23601Third Party Advisory
http://secunia.com/advisories/23614Third Party Advisory
http://secunia.com/advisories/23618Third Party Advisory
http://secunia.com/advisories/23672Third Party Advisory
http://secunia.com/advisories/23692Third Party Advisory
http://secunia.com/advisories/23988Third Party Advisory
http://secunia.com/advisories/24078Third Party Advisory
http://secunia.com/advisories/24390Third Party Advisory
http://security.gentoo.org/glsa/glsa-200701-02.xmlThird Party Advisory
http://securitytracker.com/id?1017414Third Party Advisory, VDB Entry
http://securitytracker.com/id?1017415Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.