GHSA-GH5C-2J93-H8Q7
Vulnerability from github – Published: 2022-05-01 06:54 – Updated: 2022-05-01 06:54
VLAI
Details
Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.
{
"affected": [],
"aliases": [
"CVE-2006-1993"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-04-25T12:50:00Z",
"severity": "MODERATE"
},
"details": "Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.",
"id": "GHSA-gh5c-2j93-h8q7",
"modified": "2022-05-01T06:54:50Z",
"published": "2022-05-01T06:54:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-1993"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25994"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1790"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/19802"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/20015"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/20019"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/20070"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/20214"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/22066"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/780"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1015981"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2006/dsa-1053"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2006/dsa-1055"
},
{
"type": "WEB",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200605-06.xml"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/866300"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2006/mfsa2006-30.html"
},
{
"type": "WEB",
"url": "http://www.securident.com/vuln/ff.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/431878/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/434524/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/446658/100/200/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/17671"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/1614"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/1922"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/3748"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/0083"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…