CVE-2006-1993: Buffer Overflow
Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcomcore.dll, but the vendor disputes this claim.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1993?
CVE-2006-1993 is classified as a moderate severity vulnerability due to its potential to cause denial of service and execute arbitrary code.
How do I fix CVE-2006-1993?
To fix CVE-2006-1993, upgrade your Mozilla Firefox to version 1.5.0.3 or later where the vulnerability has been addressed.
What are the potential impacts of CVE-2006-1993?
The potential impacts of CVE-2006-1993 include denial of service and the possibility of remote code execution.
Which versions of Firefox are affected by CVE-2006-1993?
CVE-2006-1993 affects Mozilla Firefox version 1.5.0.2 specifically.
Can CVE-2006-1993 be exploited remotely?
Yes, CVE-2006-1993 can be exploited remotely through specially crafted JavaScript run in an iframe.