CVE-2006-1993

The record

Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.

Affected packages

Related vulnerabilities

• CVE-2006-1730 Integer overflow in Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before… Also affects mozilla
• CVE-2006-0749 nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before… Also affects mozilla
• CVE-2005-4134 Mozilla Firefox 1.5, Netscape 8.0.4 and 7.2, and K-Meleon before 0.9.12 allows remote… Also affects mozilla
• CVE-2005-2871 Buffer overflow in the International Domain Name (IDN) support in Mozilla Firefox 1.0.6… Also affects mozilla
• CVE-2005-2265 Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote… Also affects mozilla
• CVE-2007-0009 Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services… Also affects mozilla-firefox
• CVE-2007-0981 Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and… Also affects mozilla-firefox
• CVE-2007-0045 Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before… Also affects mozilla-firefox