Podatność CVE-2006-1735

Podatność CVE-2006-1735

Publikacja: 2006-04-14 Modyfikacja: 2012-02-12

Opis:

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to execute arbitrary code by using an eval in an XBL method binding (XBL.method.eval) to create Javascript functions that are compiled with extra privileges.

Typ:

CWE-264

(Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

Ogólna skala CVSS	Znaczenie	Łatwość wykorzystania
9.3/10	10/10	8.6/10

Wymagany dostęp	Złożoność ataku	Autoryzacja
Zdalny	Średnia	Nie wymagana
Wpływ na poufność	Wpływ na integralność	Wpływ na dostępność
Pełny	Pełny	Pełny

Affected software
Mozilla -> Firefox
Mozilla -> Mozilla suite
Mozilla -> Seamonkey
Mozilla -> Thunderbird

Referencje:

ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt

ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc

http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1

http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1

http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm

http://www.debian.org/security/2006/dsa-1044

http://www.debian.org/security/2006/dsa-1046

http://www.debian.org/security/2006/dsa-1051

http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml

http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml

http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml

http://www.kb.cert.org/vuls/id/813230

http://www.mandriva.com/security/advisories?name=MDKSA-2006:075

http://www.mandriva.com/security/advisories?name=MDKSA-2006:076

http://www.mandriva.com/security/advisories?name=MDKSA-2006:078

http://www.mozilla.org/security/announce/2006/mfsa2006-14.html

http://www.novell.com/linux/security/advisories/2006_04_25.html

http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00153.html

http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00154.html

http://www.redhat.com/support/errata/RHSA-2006-0328.html

http://www.redhat.com/support/errata/RHSA-2006-0329.html

http://www.redhat.com/support/errata/RHSA-2006-0330.html

http://www.securityfocus.com/archive/1/434524/100/0/threaded

http://www.securityfocus.com/archive/1/436296/100/0/threaded

http://www.securityfocus.com/archive/1/436338/100/0/threaded

http://www.securityfocus.com/archive/1/438730/100/0/threaded

http://www.securityfocus.com/bid/17516

http://www.us-cert.gov/cas/techalerts/TA06-107A.html

http://www.vupen.com/english/advisories/2006/1356

https://exchange.xforce.ibmcloud.com/vulnerabilities/25815

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1037

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10930

https://usn.ubuntu.com/271-1/

https://usn.ubuntu.com/275-1/

https://usn.ubuntu.com/276-1/

Podatność CVE-2006-1735

CWE-264

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

9.3/10

10/10

8.6/10

Zdalny

Średnia

Nie wymagana

Pełny

Pełny

Pełny

Affected software

Referencje: