CVE-2006-2788

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-06-02 · updated 2026-06-16
Weakness: CWE-119

Description

Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via certain Javascript code.

Affected products

Mozilla Firefox: 0.8, 0.9, 0.9-rc, 0.9.1, 0.9.2, 0.9.3 (+17)

References

http://rhn.redhat.com/errata/RHSA-2006-0609.html
http://secunia.com/advisories/21269
http://secunia.com/advisories/21270
http://secunia.com/advisories/21336
http://secunia.com/advisories/21532
http://secunia.com/advisories/21631
http://secunia.com/advisories/22247
http://secunia.com/advisories/22299
http://secunia.com/advisories/22342
http://secunia.com/advisories/22849
http://www.debian.org/security/2006/dsa-1192
http://www.debian.org/security/2006/dsa-1210

Get alerted when CVE-2006-2788 or the next vulnerability affects your stack