CVE-2006-5462

Published: Nov 8, 2006Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.

Affected (28)

Products: Mozilla: Firefox, Network Security Services, Seamonkey, Thunderbird

Mozilla

4 products

Firefox

Network Security Services

Seamonkey

Thunderbird

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Network Security Services	Version 3.11.3
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 beta
Mozilla Thunderbird	Version 1.5.0.1
Mozilla Thunderbird	Version 1.5.0.2
Mozilla Thunderbird	Version 1.5.0.3
Mozilla Thunderbird	Version 1.5.0.4
Mozilla Thunderbird	Version 1.5.0.6
Mozilla Thunderbird	Version 1.5.0.7
Mozilla Thunderbird	Version 1.5
Mozilla Thunderbird	Version 1.5 beta2

References (108)

ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P (unsafe URL)

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2006-0733.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2006-0734.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2006-0735.html

Source: secalert@redhat.com

http://secunia.com/advisories/22066

Source: secalert@redhat.com

http://secunia.com/advisories/22722

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/22727

Source: secalert@redhat.com

http://secunia.com/advisories/22737

Source: secalert@redhat.com

http://secunia.com/advisories/22763

Source: secalert@redhat.com

http://secunia.com/advisories/22770

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/22815

Source: secalert@redhat.com

http://secunia.com/advisories/22817

Source: secalert@redhat.com

http://secunia.com/advisories/22929

Source: secalert@redhat.com

http://secunia.com/advisories/22965

Source: secalert@redhat.com

http://secunia.com/advisories/22980

Source: secalert@redhat.com

http://secunia.com/advisories/23009

Source: secalert@redhat.com

http://secunia.com/advisories/23013

Source: secalert@redhat.com

http://secunia.com/advisories/23197

Source: secalert@redhat.com

http://secunia.com/advisories/23202

Source: secalert@redhat.com

http://secunia.com/advisories/23235

Source: secalert@redhat.com

http://secunia.com/advisories/23263

Source: secalert@redhat.com

http://secunia.com/advisories/23287

Source: secalert@redhat.com

http://secunia.com/advisories/23297

Source: secalert@redhat.com

http://secunia.com/advisories/23883

Source: secalert@redhat.com

http://secunia.com/advisories/24711

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200612-06.xml

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200612-07.xml

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200612-08.xml

Source: secalert@redhat.com

http://securitytracker.com/id?1017180

Source: secalert@redhat.com

http://securitytracker.com/id?1017181

Source: secalert@redhat.com

http://securitytracker.com/id?1017182

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102781-1

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-246.htm

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1224

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1225

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-1227

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/335392

Source: secalert@redhat.com

PatchUS Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2006:205

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:206

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2006/mfsa2006-60.html

Source: secalert@redhat.com

Patch

http://www.mozilla.org/security/announce/2006/mfsa2006-66.html

Source: secalert@redhat.com

Patch

http://www.novell.com/linux/security/advisories/2006_68_mozilla.html

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-381-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-382-1

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA06-312A.html

Source: secalert@redhat.com

PatchUS Government Resource

http://www.vupen.com/english/advisories/2006/3748

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/4387

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/0293

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/1198

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0083

Source: secalert@redhat.com

http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00771742

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=356215

Source: secalert@redhat.com

Patch

https://exchange.xforce.ibmcloud.com/vulnerabilities/30098

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10478

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P (unsafe URL)