CVE-2006-4253
- State
- Published
- Severity
- Not scored
- Published
- Aug 21, 2006
- Updated
- Aug 7, 2024
- Reserved
- Aug 21, 2006
Description
Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads to a concurrency failure that causes structures to be freed incorrectly, as demonstrated by (1) ffoxdie and (2) ffoxdie3. NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie. Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability. NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20061017 Flaw in Firefox 2.0 RC2mailing-list
- 20060817 Re: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problemsmailing-list
- 1016847vdb-entry
- 22391third-party-advisory
- ADV-2006-3748vdb-entry
- RHSA-2006:0676vendor-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-59.html
- http://lcamtuf.coredump.cx/ffoxdie.html
- 22055third-party-advisory
- 22195third-party-advisory
- oval:org.mitre.oval:def:9528vdb-entrysignature
- USN-352-1vendor-advisory
- 21513third-party-advisory
- 21950third-party-advisory
- USN-351-1vendor-advisory
- 22025third-party-advisory
- 22056third-party-advisory
- MDKSA-2006:168vendor-advisory
- 20060812 Concurrency-related vulnerabilities in browsers - expect problemsmailing-list
- 22210third-party-advisory
- 24711third-party-advisory
- GLSA-200610-04vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-224.htm
- http://www.pianetapc.it/view.php?id=770
- ADV-2008-0083vdb-entry
- 20060817 RE: [VulnWatch] Re: Concurrency-related vulnerabilities in browsers - expect problemsmailing-list
- 21939third-party-advisory
- 1016848vdb-entry
- ADV-2006-3617vdb-entry
- 21915third-party-advisory
- ADV-2007-1198vdb-entry
- 20061006 Re: Concurrency-related vulnerabilities in browsers - expect problemsmailing-list
- RHSA-2006:0677vendor-advisory
- GLSA-200609-19vendor-advisory
- SSRT061181vendor-advisory
- 20061017 Re: Flaw in Firefox 2.0 RC2mailing-list
- 22274third-party-advisory
- RHSA-2006:0675vendor-advisory
- 21940third-party-advisory
- 22001third-party-advisory
- 20060915 rPSA-2006-0169-1 firefox thunderbirdmailing-list
- USN-350-1vendor-advisory
- 21906third-party-advisory
- 20061019 Re: Flaw in Firefox 2.0 RC2mailing-list
- GLSA-200610-01vendor-advisory
- 22074third-party-advisory
- 22066third-party-advisory
- 22088third-party-advisory
- 20060815 Re: Concurrency-related vulnerabilities in browsers - expect problemsmailing-list
- 21949third-party-advisory
- SUSE-SA:2006:054vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=348514
- 19534vdb-entry
- https://issues.rpath.com/browse/RPL-640
- 20061005 Re: Concurrency-related vulnerabilities in browsers - expect problemsmailing-list
- http://lcamtuf.coredump.cx/ffoxdie3.html
- 20061025 Mozilla Firefox JavaScript Handler Race Condition Memory Corruption Vulnerabilitymailing-list
- 22036third-party-advisory
- 1016846vdb-entry
- USN-354-1vendor-advisory
- 19488vdb-entry
- 20061023 Flaw in Firefox 2.0 Finalmailing-list
- 22422third-party-advisory
- MDKSA-2006:169vendor-advisory
- http://www.securiteam.com/securitynews/5VP0M0AJFW.html
- 21916third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.