CVE-2006-0294
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey...
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
- Record
CVE-2006-0294- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
- Record
CVE-2006-0294- Updated
- 2026-11-02
EUVDEUVD-2006-0301 No score
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
- Record
EUVD-2006-0301- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mjg-gvfx-f783 No score
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey...
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
- Record
GHSA-3mjg-gvfx-f783- Updated
- 2026-11-02
OSV No score
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
- Record
CVE-2006-0294- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-0294 No score
Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 allow remote attackers to execute arbitrary code by changing an element's style from position:relative to position:static, which causes Gecko to operate on freed memory.
- Record
DEBIAN-CVE-2006-0294- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 |
before 1.5.0.2-1 | 1.5.0.2-1 |
thunderbirdDebian:13 |
before 1.5.0.2-1 | 1.5.0.2-1 |
thunderbirdDebian:14 |
before 1.5.0.2-1 | 1.5.0.2-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0294 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published February 2, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.93%, the 92nd percentile. Fixed in thunderbird 1.5.0.2-1.
References
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1514
secunia.com/advisories/18704
vupen.com/english/advisories/2006/3749
securityfocus.com/bid/16476
securitytracker.com/id?1015570
Show 9 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/24431
bugzilla.mozilla.org/show_bug.cgi?id=317934
mozilla.org/security/announce/2006/mfsa2006-02.html
nvd.nist.gov/vuln/detail/CVE-2006-0294
github.com/advisories/GHSA-3mjg-gvfx-f783
security-tracker.debian.org/tracker/CVE-2006-0294