CVE-2006-3806 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

Multiple integer overflows in the Javascript engine in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via vectors involving (1) long strings in the toSource method of the Object, Array, and String objects; and (2) unspecified "string function arguments."

CVSS Score

7.5

HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Mozilla	Firefox	1.5
Mozilla	Seamonkey	1.0
Mozilla	Thunderbird	1.5

Related Weaknesses (CWE)

CWE-189

References

ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc
http://rhn.redhat.com/errata/RHSA-2006-0609.htmlVendor Advisory
http://secunia.com/advisories/19873PatchVendor Advisory
http://secunia.com/advisories/21216PatchVendor Advisory
http://secunia.com/advisories/21228PatchVendor Advisory
http://secunia.com/advisories/21229PatchVendor Advisory
http://secunia.com/advisories/21243Vendor Advisory
http://secunia.com/advisories/21246Vendor Advisory
http://secunia.com/advisories/21250Vendor Advisory
http://secunia.com/advisories/21262Vendor Advisory
http://secunia.com/advisories/21269Vendor Advisory
http://secunia.com/advisories/21270Vendor Advisory
http://secunia.com/advisories/21275Vendor Advisory
http://secunia.com/advisories/21336Vendor Advisory
http://secunia.com/advisories/21343Vendor Advisory

FAQ

What is CVE-2006-3806?

CVE-2006-3806 is a vulnerability with a CVSS score of 7.5 (HIGH). Multiple integer overflows in the Javascript engine in Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code via...

How severe is CVE-2006-3806?

CVE-2006-3806 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2006-3806?

Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird.