CVE-2006-0294

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-02-02 · updated 2026-06-16

Description

Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.

Affected products

Mozilla Firefox: 0.8, 0.9, 0.9-rc, 0.9.1, 0.9.2, 0.9.3 (+12)
Mozilla Seamonkey: 1.0, 1.0-beta
Mozilla Thunderbird: 1.5

References

http://secunia.com/advisories/18700
http://secunia.com/advisories/18704
http://secunia.com/advisories/22065
http://securitytracker.com/id?1015570
http://www.mozilla.org/security/announce/2006/mfsa2006-02.html
http://www.securityfocus.com/archive/1/446657/100/200/threaded
http://www.securityfocus.com/bid/16476
http://www.vupen.com/english/advisories/2006/0413
http://www.vupen.com/english/advisories/2006/3749
https://bugzilla.mozilla.org/show_bug.cgi?id=317934
https://exchange.xforce.ibmcloud.com/vulnerabilities/24431
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1514

Get alerted when CVE-2006-0294 or the next vulnerability affects your stack