VulnerabilityModified

CVE-2006-6504

Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.

HIGH 9.3EPSS 8.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 8.67% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: mozilla/firefox · mozilla/seamonkey · canonical/ubuntu linux
Source: secalert@redhat.com

References

ftp://patches.sgi.com/support/free/security/advisories/20061202-01-P.ascBroken Link
http://fedoranews.org/cms/node/2297Broken Link
http://fedoranews.org/cms/node/2338Broken Link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Broken Link
http://rhn.redhat.com/errata/RHSA-2006-0758.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2006-0759.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2006-0760.htmlThird Party Advisory
http://secunia.com/advisories/23282Third Party Advisory
http://secunia.com/advisories/23422Third Party Advisory
http://secunia.com/advisories/23433Third Party Advisory
http://secunia.com/advisories/23439Third Party Advisory
http://secunia.com/advisories/23440Third Party Advisory
http://secunia.com/advisories/23468Third Party Advisory
http://secunia.com/advisories/23514Third Party Advisory
http://secunia.com/advisories/23545Third Party Advisory
http://secunia.com/advisories/23589Third Party Advisory
http://secunia.com/advisories/23601Third Party Advisory
http://secunia.com/advisories/23614Third Party Advisory
http://secunia.com/advisories/23618Third Party Advisory
http://secunia.com/advisories/23672Third Party Advisory
http://secunia.com/advisories/23692Third Party Advisory
http://security.gentoo.org/glsa/glsa-200701-02.xmlThird Party Advisory
http://securitytracker.com/id?1017417Third Party Advisory, VDB Entry
http://securitytracker.com/id?1017418Third Party Advisory, VDB Entry
http://www.gentoo.org/security/en/glsa/glsa-200701-04.xmlThird Party Advisory
http://www.kb.cert.org/vuls/id/928956Third Party Advisory, US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2007:010Third Party Advisory
http://www.mozilla.org/security/announce/2006/mfsa2006-73.htmlVendor Advisory
http://www.novell.com/linux/security/advisories/2006_80_mozilla.htmlBroken Link
http://www.novell.com/linux/security/advisories/2007_06_mozilla.htmlBroken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.