Vulnerability Description
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 1.5 |
| Mozilla | Network Security Services | 3.11.3 |
| Mozilla | Seamonkey | 1.0 |
| Mozilla | Thunderbird | 1.5 |
References
- ftp://patches.sgi.com/support/free/security/advisories/20061101-01-P
- http://rhn.redhat.com/errata/RHSA-2006-0733.html
- http://rhn.redhat.com/errata/RHSA-2006-0734.html
- http://rhn.redhat.com/errata/RHSA-2006-0735.html
- http://secunia.com/advisories/22066
- http://secunia.com/advisories/22722PatchVendor Advisory
- http://secunia.com/advisories/22727
- http://secunia.com/advisories/22737
- http://secunia.com/advisories/22763
- http://secunia.com/advisories/22770PatchVendor Advisory
- http://secunia.com/advisories/22815
- http://secunia.com/advisories/22817
- http://secunia.com/advisories/22929
- http://secunia.com/advisories/22965
- http://secunia.com/advisories/22980
FAQ
What is CVE-2006-5462?
CVE-2006-5462 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, ...
How severe is CVE-2006-5462?
CVE-2006-5462 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-5462?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Network Security Services, Mozilla Seamonkey, Mozilla Thunderbird.