CVE-2006-4567

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-09-15 · updated 2026-06-16

Description

Mozilla Firefox before 1.5.0.7 and Thunderbird before 1.5.0.7 makes it easy for users to accept self-signed certificates for the auto-update mechanism, which might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site, which can then be used to install arbitrary code on the next update.

Affected products

Mozilla Firefox: through 1.5.0.6
Mozilla Thunderbird: through 1.5.0.6

References

http://secunia.com/advisories/21906
http://secunia.com/advisories/21916
http://secunia.com/advisories/21939
http://secunia.com/advisories/21949
http://secunia.com/advisories/21950
http://secunia.com/advisories/22001
http://secunia.com/advisories/22025
http://secunia.com/advisories/22055
http://secunia.com/advisories/22056
http://secunia.com/advisories/22066
http://secunia.com/advisories/22074
http://secunia.com/advisories/22088

Get alerted when CVE-2006-4567 or the next vulnerability affects your stack