RCE in Mozilla Firefox
CVE-2006-6504
Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and SeaMonkey before 1.0.7 allows remote attackers to execute arbitrary code by appending an SVG comment DOM node to another type of document, which triggers memory corruption.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.087 (94.6th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox
- Mozilla Seamonkey
- Canonical Ubuntu_linux — versions 5.10, 6.06, 6.10
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (Third Party Advisory, vdb-entry, x_refsource_VUPEN)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2006-6504?
- CVE-2006-6504 is a vulnerability in Mozilla Firefox, classified under Code Injection. Published 2006-12-20.
- Is CVE-2006-6504 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.