CVE-2006-0295

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-02-02 · updated 2026-06-16

Description

Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.

Affected products

Mozilla Firefox: 1.5
Mozilla Seamonkey: 1.0, 1.0-beta
Mozilla Thunderbird: 1.5

References

http://secunia.com/advisories/18700
http://secunia.com/advisories/18704
http://secunia.com/advisories/22065
http://securitytracker.com/id?1015570
http://www.kb.cert.org/vuls/id/759273
http://www.mozilla.org/security/announce/2006/mfsa2006-04.html
http://www.securityfocus.com/archive/1/446657/100/200/threaded
http://www.securityfocus.com/bid/16476
http://www.us-cert.gov/cas/techalerts/TA06-038A.html
http://www.vupen.com/english/advisories/2006/0413
http://www.vupen.com/english/advisories/2006/3749
https://bugzilla.mozilla.org/show_bug.cgi?id=319296

Get alerted when CVE-2006-0295 or the next vulnerability affects your stack