CVE-2006-5633

2006-10-3122:07:00

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

7.2

Confidence

High

EPSS

0.407

Percentile

97.3%

JSON

Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b, allows remote attackers to cause a denial of service (crash) by creating a range object using createRange, calling selectNode on a DocType node (DOCUMENT_TYPE_NODE), then calling createContextualFragment on the range, which triggers a null dereference. NOTE: the original Bugtraq post mentioned that code execution was possible, but followup analysis has shown that it is only a null dereference.

Affected configurations

Nvd

Node

mozillafirefoxMatch1.5.0.7

mozillafirefoxMatch2.0

mozillaseamonkeyMatch1.1beta

VendorProductVersionCPE
mozillafirefox1.5.0.7cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
mozillafirefox2.0cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
mozillaseamonkey1.1cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	1.5.0.7	cpe:2.3:a:mozilla:firefox:1.5.0.7:::::::*
mozilla	firefox	2.0	cpe:2.3:a:mozilla:firefox:2.0:::::::*
mozilla	seamonkey	1.1	cpe:2.3:a:mozilla:seamonkey:1.1:beta::::::