CVEvulnerability

CVE-2006-1733

6.8 MEDIUM Published 2006-04-14 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-04-14
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-264

Description

Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 does not properly protect the compilation scope of privileged built-in XBL bindings, which allows remote attackers to execute arbitrary code via the (1) valueOf.call or (2) valueOf.apply methods of an XBL binding, or (3) "by inserting an XBL method into the DOM's document.body prototype chain."

Affected configurations

• mozilla firefox (<= 1.0.7) • mozilla firefox 1.0 • mozilla firefox 1.0.1 • mozilla firefox 1.0.2 • mozilla firefox 1.0.3 • mozilla firefox 1.0.4 • mozilla firefox 1.0.5 • mozilla firefox 1.0.6 • mozilla firefox 1.5 • mozilla mozilla suite (<= 1.7.12) • mozilla mozilla suite 1.7.6 • mozilla mozilla suite 1.7.7 • mozilla mozilla suite 1.7.8 • mozilla mozilla suite 1.7.10 • mozilla mozilla suite 1.7.11 • mozilla seamonkey (<= 1.0) • mozilla seamonkey 1.0 • mozilla thunderbird (<= 1.0.7) • mozilla thunderbird 1.0 • mozilla thunderbird 1.0.1 • mozilla thunderbird 1.0.2 • mozilla thunderbird 1.0.3 • mozilla thunderbird 1.0.4 • mozilla thunderbird 1.0.5 • mozilla thunderbird 1.0.6 • mozilla thunderbird 1.5

Related

Weakness · not in database (1)

References