CVE-2006-1993
MEDIUM 5.1EPSS 54.0%
Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.
- CVSS v2.0 NVD
- 5.1 MEDIUM
AV:N/AC:H/Au:N/C:P/I:P/A:P - EPSS
- 54.00% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2006-04-25
- Updated
- 2024-08-07
ExploitDB entries (1)
Security advisories
- http://secunia.com/advisories/19802
- http://secunia.com/advisories/20015
- http://secunia.com/advisories/20019
- http://secunia.com/advisories/20070
- http://secunia.com/advisories/20214
- http://secunia.com/advisories/22066
- http://www.mozilla.org/security/announce/2006/mfsa2006-30.html
- http://www.vupen.com/english/advisories/2006/1614
- http://www.vupen.com/english/advisories/2006/1922
- http://www.vupen.com/english/advisories/2006/3748
- http://www.vupen.com/english/advisories/2008/0083
- http://www.kb.cert.org/vuls/id/866300
- http://www.securityfocus.com/bid/17671