CVE-2006-0884

Published: Feb 24, 2006Modified: Apr 16, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The WYSIWYG rendering engine ("rich mail" editor) in Mozilla Thunderbird 1.0.7 and earlier allows user-assisted attackers to bypass javascript security settings and obtain sensitive information or cause a crash via an e-mail containing a javascript URI in the SRC attribute of an IFRAME tag, which is executed when the user edits the e-mail.

Affected (18)

Products: Mozilla: Thunderbird

Mozilla

1 product

Thunderbird

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Mozilla Thunderbird	Up to 1.0.7
Mozilla Thunderbird	Version 0.1
Mozilla Thunderbird	Version 0.2
Mozilla Thunderbird	Version 0.3
Mozilla Thunderbird	Version 0.4
Mozilla Thunderbird	Version 0.5
Mozilla Thunderbird	Version 0.6
Mozilla Thunderbird	Version 0.7.1
Mozilla Thunderbird	Version 0.7.2
Mozilla Thunderbird	Version 0.7.3
Mozilla Thunderbird	Version 0.7
Mozilla Thunderbird	Version 0.8
Mozilla Thunderbird	Version 0.9
Mozilla Thunderbird	Version 1.0.1
Mozilla Thunderbird	Version 1.0.2
Mozilla Thunderbird	Version 1.0.5
Mozilla Thunderbird	Version 1.0.6
Mozilla Thunderbird	Version 1.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (82)

ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt (unsafe URL)

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc (unsafe URL)

Source: cve@mitre.org

http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html

Source: cve@mitre.org

http://secunia.com/advisories/19721

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/19811

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/19821

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/19823

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/19863

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/19902

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/19941

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/19950

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/20051

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21033

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21622

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/22065

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1015665

Source: cve@mitre.org

Exploit

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm

Source: cve@mitre.org

http://www.debian.org/security/2006/dsa-1046

Source: cve@mitre.org

Patch

http://www.debian.org/security/2006/dsa-1051

Source: cve@mitre.org

Patch

http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2006:052

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2006:076

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2006:078

Source: cve@mitre.org

http://www.mozilla.org/security/announce/2006/mfsa2006-21.html

Source: cve@mitre.org

Vendor Advisory

http://www.novell.com/linux/security/advisories/2006_04_25.html

Source: cve@mitre.org

http://www.osvdb.org/23653

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2006-0329.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2006-0330.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/425786/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/436296/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/438730/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/446657/100/200/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/16770

Source: cve@mitre.org

ExploitPatch

http://www.vupen.com/english/advisories/2006/3749

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/25983

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10782

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2024

Source: cve@mitre.org

https://usn.ubuntu.com/276-1/

Source: cve@mitre.org

ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt (unsafe URL)