CVE-2006-2775
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under...
CVE-2006-2775 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published June 2, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.57%, the 91st percentile. Fixed in thunderbird 1.5.0.4-1.
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
CVE-2006-2775- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
CVE-2006-2775- Updated
- 2026-11-02
EUVDEUVD-2006-2772 No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
EUVD-2006-2772- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vvv2-hwwj-rm5q No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under...
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
GHSA-vvv2-hwwj-rm5q- Updated
- 2026-11-02
OSV No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
CVE-2006-2775- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-2775 No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
DEBIAN-CVE-2006-2775- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 |
before 1.5.0.4-1 | 1.5.0.4-1 |
thunderbirdDebian:13 |
before 1.5.0.4-1 | 1.5.0.4-1 |
thunderbirdDebian:14 |
before 1.5.0.4-1 | 1.5.0.4-1 |
mozillaDebian:3.1 |
before 2:1.7.8-1sarge7.1, plus listed versions 2:1.7.8-12:1.7.8-1sarge12:1.7.8-1sarge22:1.7.8-1sarge32:1.7.8-1sarge52:1.7.8-1sarge62:1.7.8-1sarge7 |
2:1.7.8-1sarge7.1 |
mozilla-firefoxDebian:3.1 |
before 1.0.4-2sarge9, plus listed versions 1.0.4-21.0.4-2sarge11.0.4-2sarge21.0.4-2sarge31.0.4-2sarge41.0.4-2sarge51.0.4-2sarge61.0.4-2sarge7 |
1.0.4-2sarge9 |
mozilla-thunderbirdDebian:3.1 |
before 1.0.2-2.sarge1.0.8a, plus listed versions 1.0.2-21.0.2-2.sarge1.0.61.0.2-2.sarge1.0.71.0.2-2.sarge1.0.8 |
1.0.2-2.sarge1.0.8a |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/20709
mandriva.com/security/advisories?name=MDKSA-2006:145
vupen.com/english/advisories/2006/3748
usn.ubuntu.com/297-3
Show 39 moreShow less
mozilla.org/security/announce/2006/mfsa2006-35.html
us-cert.gov/cas/techalerts/TA06-153A.html
securitytracker.com/id?1016214
securityfocus.com/archive/1/435795/100/0/threaded
gentoo.org/security/en/glsa/glsa-200606-21.xml
debian.org/security/2006/dsa-1118
kb.cert.org/vuls/id/243153
novell.com/linux/security/advisories/2006_35_mozilla.html
exchange.xforce.ibmcloud.com/vulnerabilities/26846
nvd.nist.gov/vuln/detail/CVE-2006-2775
github.com/advisories/GHSA-vvv2-hwwj-rm5q
security-tracker.debian.org/tracker/CVE-2006-2775