CVE-2006-1731

CVSS V2 Medium 4.3 CVSS V3 None
Description
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Overview
  • CVE ID
  • CVE-2006-1731
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2006-04-14T10:02:00
  • Last Modified Date
  • 2018-10-18T16:34:49
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* 1 OR 1.0.7
cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:mozilla_suite:*:*:*:*:*:*:*:* 1 OR 1.7.12
cpe:2.3:a:mozilla:mozilla_suite:1.7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:mozilla_suite:1.7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:mozilla_suite:1.7.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:mozilla_suite:1.7.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:mozilla_suite:1.7.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:seamonkey:*:beta:*:*:*:*:*:* 1 OR 1.0
cpe:2.3:a:mozilla:seamonkey:1.0:*:alpha:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* 1 OR 1.0.7
cpe:2.3:a:mozilla:thunderbird:1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.0.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.0.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.0.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.0.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.0.5:beta:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.0.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mozilla:thunderbird:1.5:beta2:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.mozilla.org/security/announce/2006/mfsa2006-19.html
http://www.redhat.com/support/errata/RHSA-2006-0328.html
http://www.securityfocus.com/bid/17516
http://secunia.com/advisories/19631
http://www.debian.org/security/2006/dsa-1044
http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml
http://secunia.com/advisories/19759
http://secunia.com/advisories/19794
http://secunia.com/advisories/19821
http://www.debian.org/security/2006/dsa-1046
http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml
ftp://patches.sgi.com/support/free/security/advisories/20060404-01-U.asc
http://secunia.com/advisories/19811
http://secunia.com/advisories/19823
http://secunia.com/advisories/19852
http://secunia.com/advisories/19862
http://secunia.com/advisories/19863
http://secunia.com/advisories/19902
http://www.debian.org/security/2006/dsa-1051
http://secunia.com/advisories/19950
http://secunia.com/advisories/19941
http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00153.html
http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00154.html
http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
http://secunia.com/advisories/19714
http://secunia.com/advisories/19721
http://secunia.com/advisories/19746
http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml
http://www.redhat.com/support/errata/RHSA-2006-0329.html
http://www.redhat.com/support/errata/RHSA-2006-0330.html
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.26/SCOSA-2006.26.txt
http://secunia.com/advisories/21033
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1
http://secunia.com/advisories/21622
http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm
http://secunia.com/advisories/19696
http://secunia.com/advisories/19729
http://secunia.com/advisories/19780
http://secunia.com/advisories/20051
http://www.mandriva.com/security/advisories?name=MDKSA-2006:075
http://www.mandriva.com/security/advisories?name=MDKSA-2006:076
http://www.mandriva.com/security/advisories?name=MDKSA-2006:078
http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1
http://www.vupen.com/english/advisories/2006/1356
http://www.vupen.com/english/advisories/2006/3391
http://www.novell.com/linux/security/advisories/2006_04_25.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/25820
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9604
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1955
https://usn.ubuntu.com/276-1/
https://usn.ubuntu.com/275-1/
https://usn.ubuntu.com/271-1/
http://www.securityfocus.com/archive/1/438730/100/0/threaded
http://www.securityfocus.com/archive/1/436338/100/0/threaded
http://www.securityfocus.com/archive/1/436296/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2006-1731
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731
History
Created Old Value New Value Data Type Notes
2022-05-10 18:09:01 Added to TrackCVE