CVE-2006-5462: Medium severity Mozilla Thunderbird vulnerability
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-5462?
CVE-2006-5462 is considered a moderate severity vulnerability that allows remote attackers to potentially forge signatures.
How do I fix CVE-2006-5462?
To fix CVE-2006-5462, upgrade the affected software to versions 1.5.0.8 or later for Firefox, 1.5.0.8 or later for Thunderbird, 1.0.6 or later for SeaMonkey, or NSS library version 3.11.3 or later.
Which versions are affected by CVE-2006-5462?
CVE-2006-5462 affects Mozilla Firefox versions prior to 1.5.0.8, Thunderbird versions prior to 1.5.0.8, and SeaMonkey versions prior to 1.0.6.
Can CVE-2006-5462 lead to data breaches?
Yes, CVE-2006-5462 can potentially lead to data breaches by allowing attackers to forge signatures, thereby impersonating legitimate entities.
Is CVE-2006-5462 still a risk for current Mozilla software?
CVE-2006-5462 is not a risk for current Mozilla software as long as users keep their applications updated to the latest versions.