Lucene search

K
certCERTVU:606260
HistoryDec 20, 2006 - 12:00 a.m.

Mozilla Layout Engine vulnerability

2006-12-2000:00:00
www.kb.cert.org
15

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.799 High

EPSS

Percentile

98.2%

Overview

A vulnerability exists in the Mozilla Layout Engine that may allow a remote attacker to compromise a vulnerable system.

Description

The Mozilla Layout Engine contains an unspecified vulnerability that may result in memory corruption. The impact of this memory corruption is unclear. According to Mozilla Foundation Security Advisory 2006-68:

Some of these were crashes that showed evidence of memory corruption and we presume that at least some of these could be exploited to run arbitrary code with enough effort.


Impact

The specific consequences of this vulnerability are not clear, but may include execution of arbitrary code and denial of service.


Solution

Apply an update

According to the Mozilla Foundation Security Update 2006-68, this vulnerability is addressed in Firefox 2.0.0.1, Firefox 1.5.0.9, Thunderbird 1.5.0.9, and SeaMonkey 1.0.7.


Disable JavaScript

For instructions on how to disable JavaScript in Firefox, please refer to the Firefox section of the Securing Your Web Browser document.


Vendor Information

606260

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Mozilla __ Affected

Updated: December 20, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Refer to Mozilla Foundation Security Advisory 2006-68.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23606260 Feedback>).

CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was reported in Mozilla Foundation Security Advisory 2006-68. Mozilla credits Andrew Miller, David Baron, Georgi Guninski, Jesse Ruderman, Olli Pettay and Vladimir Vukicevic with providing information about this issue.

This document was written by Chris Taschner.

Other Information

CVE IDs: CVE-2006-6497
Severity Metric: 4.13 Date Public:

References

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.799 High

EPSS

Percentile

98.2%

Related for VU:606260