CVE-2006-0295
NoneCVSS
—
EPSS
71.3%
Published
Feb 2, 2006
CISA due date
—
The record
Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | thunderbird | 0 | 1.5.0.2-1 |
| Debian:12 | thunderbird | 0 | 1.5.0.2-1 |
| Debian:13 | thunderbird | 0 | 1.5.0.2-1 |
Related vulnerabilities
- CVE-2025-0243 Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and… Also affects thunderbird
- CVE-2025-0237 The WebChannel API, which is used to transport various information across processes, did… Also affects thunderbird
- CVE-2025-0238 Assuming a controlled failed memory allocation, an attacker could have caused a… Also affects thunderbird
- CVE-2025-0240 Parsing a JavaScript module as JSON could, under some circumstances, cause… Also affects thunderbird
- CVE-2025-0239 When using Alt-Svc, ALPN did not properly validate certificates when the original server… Also affects thunderbird
- CVE-2025-0241 When segmenting specially crafted text, segmentation would corrupt memory leading to a… Also affects thunderbird
- CVE-2025-0242 Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox… Also affects thunderbird
- CVE-2024-11704 A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when… Also affects thunderbird