CVE-2006-1273: High severity Mozilla Firefox vulnerability

Published Mar 19, 2006

Updated

DISPUTED Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to cause a denial of service (crash) via an HTML tag with a large number of script action handlers such as onload and onmouseover, which triggers the crash when the user views the page source. NOTE: Red Hat has disputed this issue, suggesting that "It is likely the reporter was running the IE Tab extension," and Mozilla also confirmed that this is not an issue in Firefox itself.

Affected Software

2 affected components

Mozilla Firefox=1.0.7

Mozilla Firefox=1.5.0.1

Event History

Mar 19, 2006

CVE Published

11:06 AM

Disputed

11:06 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1273?

CVE-2006-1273 is classified as a denial of service vulnerability.

How do I fix CVE-2006-1273?

To mitigate CVE-2006-1273, upgrade Mozilla Firefox to a version later than 1.5.0.1.

What versions of Mozilla Firefox are affected by CVE-2006-1273?

Versions 1.0.7 and 1.5.0.1 of Mozilla Firefox are affected by CVE-2006-1273.

Can CVE-2006-1273 be exploited remotely?

Yes, CVE-2006-1273 can be exploited remotely by attackers using a specially crafted HTML tag.

What issues does CVE-2006-1273 cause in Mozilla Firefox?

CVE-2006-1273 causes Mozilla Firefox to crash when the user views the page source containing the exploit.