CVE-2006-1731: XSS
First published: Fri Apr 14 2006(Updated: )
Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 returns the Object class prototype instead of the global window object when (1) .valueOf.call or (2) .valueOf.apply are called without any arguments, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox and Thunderbird | =1.5-beta2 | |
| Mozilla Suite | <=1.7.12 | |
| Mozilla Firefox and Thunderbird | =1.0.2 | |
| Mozilla Firefox and Thunderbird | =1.5-beta1 | |
| Mozilla Firefox and Thunderbird | =1.5 | |
| Mozilla Suite | =1.7.10 | |
| Mozilla Firefox and Thunderbird | =1.0.4 | |
| Mozilla Suite | =1.7.8 | |
| Mozilla Firefox and Thunderbird | =1.0 | |
| Mozilla Firefox and Thunderbird | =1.0.1 | |
| Mozilla Firefox and Thunderbird | =1.5-beta2 | |
| Mozilla SeaMonkey | =1.0 | |
| Mozilla Firefox and Thunderbird | =1.0.2 | |
| Mozilla Suite | =1.7.11 | |
| Mozilla Firefox and Thunderbird | =1.0 | |
| Mozilla Firefox and Thunderbird | =1.5 | |
| Mozilla Firefox and Thunderbird | =1.0.1 | |
| Mozilla Firefox and Thunderbird | =1.0.4 | |
| Mozilla Firefox and Thunderbird | =1.0.3 | |
| Mozilla Firefox and Thunderbird | =1.0.3 | |
| Mozilla Firefox and Thunderbird | =1.0.6 | |
| Mozilla Firefox and Thunderbird | =1.0.5-beta | |
| Mozilla Suite | =1.7.7 | |
| Mozilla Firefox and Thunderbird | <=1.0.7 | |
| Mozilla Suite | =1.7.6 | |
| Mozilla SeaMonkey | <=1.0 | |
| Mozilla Firefox and Thunderbird | <=1.0.7 | |
| Mozilla Firefox and Thunderbird | =1.0.5 | |
| Mozilla Firefox and Thunderbird | =1.0.5 | |
| Mozilla Firefox and Thunderbird | =1.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.mozilla.org/security/announce/2006/mfsa2006-19.html
- http://www.redhat.com/support/errata/RHSA-2006-0328.html
- http://www.securityfocus.com/bid/17516
- http://secunia.com/advisories/19631
- http://www.debian.org/security/2006/dsa-1044
- http://www.gentoo.org/security/en/glsa/glsa-200604-12.xml
- http://secunia.com/advisories/19759
- http://secunia.com/advisories/19794
- http://secunia.com/advisories/19821
- http://www.debian.org/security/2006/dsa-1046
- http://www.gentoo.org/security/en/glsa/glsa-200604-18.xml
- http://secunia.com/advisories/19811
- http://secunia.com/advisories/19823
- http://secunia.com/advisories/19852
- http://secunia.com/advisories/19862
- http://secunia.com/advisories/19863
- http://secunia.com/advisories/19902
- http://www.debian.org/security/2006/dsa-1051
- http://secunia.com/advisories/19950
- http://secunia.com/advisories/19941
- http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00153.html
- http://www.redhat.com/archives/fedora-announce-list/2006-April/msg00154.html
- http://lists.suse.com/archive/suse-security-announce/2006-Apr/0003.html
- http://secunia.com/advisories/19714
- http://secunia.com/advisories/19721
- http://secunia.com/advisories/19746
- http://www.gentoo.org/security/en/glsa/glsa-200605-09.xml
- http://www.redhat.com/support/errata/RHSA-2006-0329.html
- http://www.redhat.com/support/errata/RHSA-2006-0330.html
- http://secunia.com/advisories/21033
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102550-1
- http://secunia.com/advisories/21622
- http://support.avaya.com/elmodocs2/security/ASA-2006-205.htm
- http://secunia.com/advisories/19696
- http://secunia.com/advisories/19729
- http://secunia.com/advisories/19780
- http://secunia.com/advisories/20051
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:075
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:076
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:078
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-228526-1
- http://www.vupen.com/english/advisories/2006/1356
- http://www.vupen.com/english/advisories/2006/3391
- http://www.novell.com/linux/security/advisories/2006_04_25.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25820
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9604
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1955
- https://usn.ubuntu.com/276-1/
- https://usn.ubuntu.com/275-1/
- https://usn.ubuntu.com/271-1/
- http://www.securityfocus.com/archive/1/438730/100/0/threaded
- http://www.securityfocus.com/archive/1/436338/100/0/threaded
- http://www.securityfocus.com/archive/1/436296/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2006-1731?
CVE-2006-1731 is classified as a moderate severity vulnerability.
How do I fix CVE-2006-1731?
To fix CVE-2006-1731, update Mozilla Firefox, Mozilla Suite, Thunderbird, or SeaMonkey to the latest version that addresses this vulnerability.
What versions are affected by CVE-2006-1731?
CVE-2006-1731 affects Mozilla Firefox versions before 1.5, Mozilla Suite versions before 1.7.13, Thunderbird versions before 1.5, and SeaMonkey before 1.0.
What type of attack can exploit CVE-2006-1731?
CVE-2006-1731 allows remote attackers to execute arbitrary JavaScript code in a browser security context via the Object class prototype.
Is there a workaround for CVE-2006-1731?
There are no effective workarounds for CVE-2006-1731; the only resolution is to update to a secure version.
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/mozilla
- canonical/mozilla firefox and thunderbird
- version/mozilla firefox and thunderbird/1.5-beta2
- canonical/mozilla suite
- version/mozilla suite/1.7.12
- version/mozilla firefox and thunderbird/1.0.2
- version/mozilla firefox and thunderbird/1.5-beta1
- version/mozilla firefox and thunderbird/1.5
- version/mozilla suite/1.7.10
- version/mozilla firefox and thunderbird/1.0.4
- version/mozilla suite/1.7.8
- version/mozilla firefox and thunderbird/1.0
- version/mozilla firefox and thunderbird/1.0.1
- canonical/mozilla seamonkey
- version/mozilla seamonkey/1.0
- version/mozilla suite/1.7.11
- version/mozilla firefox and thunderbird/1.0.3
- version/mozilla firefox and thunderbird/1.0.6
- version/mozilla firefox and thunderbird/1.0.5-beta
- version/mozilla suite/1.7.7
- version/mozilla firefox and thunderbird/1.0.7
- version/mozilla suite/1.7.6
- version/mozilla firefox and thunderbird/1.0.5