p PatchFirst

CVE-2006-4253

CVE-2006-4253

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads to a concurrency failure that causes structures to be freed incorrectly, as demonstrated by (1) ffoxdie and (2) ffoxdie3. NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie. Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability. NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected.

EPSS 15.2% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • thunderbird Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.5.0.7-1

    Update to 1.5.0.7-1

  • thunderbird Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.5.0.7-1

    Update to 1.5.0.7-1

  • thunderbird Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.5.0.7-1

    Update to 1.5.0.7-1

Original sources

Check your server →