CVE-2006-2894: Input Validation
Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2894?
CVE-2006-2894 is classified as a medium-severity vulnerability due to its potential for exploitation through user interaction.
How do I fix CVE-2006-2894?
To fix CVE-2006-2894, update affected software such as Mozilla Firefox to version 2.0.0.8 or later, and other impacted applications to their latest versions.
Which versions are affected by CVE-2006-2894?
CVE-2006-2894 affects Mozilla Firefox versions up to 2.0.0.8, Mozilla Suite version 1.7.13, and various versions of Mozilla SeaMonkey and Netscape Navigator.
What type of attacks does CVE-2006-2894 enable?
CVE-2006-2894 allows user-assisted remote attackers to read arbitrary files on the user's system.
Is user interaction required for CVE-2006-2894 to be exploited?
Yes, CVE-2006-2894 requires user interaction, specifically tricking the user into typing the filename in a text box.