Vulnerability Details : CVE-2006-2781
Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a VCard that contains invalid base64 characters.
Vulnerability category: OverflowMemory CorruptionExecute codeDenial of service
Products affected by CVE-2006-2781
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-2781
11.00%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-2781
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:P |
10.0
|
4.9
|
NIST |
CWE ids for CVE-2006-2781
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2006-2781
-
http://www.mandriva.com/security/advisories?name=MDKSA-2006:146
Mandriva
-
http://www.securityfocus.com/archive/1/435795/100/0/threaded
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10247
404 Not Found
-
http://www.vupen.com/english/advisories/2006/2106
Site en construction
-
http://www.vupen.com/english/advisories/2006/3749
Site en construction
-
http://www.debian.org/security/2006/dsa-1134
[SECURITY] [DSA 1134-1] New Mozilla Thunderbird packages fix several vulnerabilities
-
http://rhn.redhat.com/errata/RHSA-2006-0609.html
RHSA-2006:0609 - Security Advisory - Red Hat Customer Portal
-
http://www.gentoo.org/security/en/glsa/glsa-200606-21.xml
Mozilla Thunderbird: Multiple vulnerabilities (GLSA 200606-21) — Gentoo security
-
http://www.redhat.com/support/errata/RHSA-2006-0611.html
Support
-
https://usn.ubuntu.com/297-3/
404: Page not found | Ubuntu
-
https://usn.ubuntu.com/297-1/
404: Page not found | Ubuntu
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/26850
Mozilla Thunderbird and SeaMonkey VCard double-free memory corruption CVE-2006-2781 Vulnerability Report
-
http://www.securityfocus.com/bid/18228
-
http://www.novell.com/linux/security/advisories/2006_35_mozilla.html
Security - Support | SUSE
-
http://www.redhat.com/support/errata/RHSA-2006-0594.html
Support
-
http://www.mozilla.org/security/announce/2006/mfsa2006-40.html
Double-free on malformed VCard — Mozilla
-
http://www.redhat.com/support/errata/RHSA-2006-0578.html
Support
-
https://usn.ubuntu.com/323-1/
404: Page not found | Ubuntu
-
http://www.securityfocus.com/archive/1/446657/100/200/threaded
-
http://www.debian.org/security/2006/dsa-1118
Debian -- The Universal Operating System
-
http://securitytracker.com/id?1016214
Access Denied
Jump to