CVE-2006-3802
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows...
5.8 MediumFix available
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
Exploit likelihood
2.36%Down 1.6 points since Feb 4, 2022
What each source reports
NVD Score used
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
- Record
CVE-2006-3802- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
- Record
CVE-2006-3802- Updated
- 2026-11-02
EUVDEUVD-2006-3796 No score
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
- Record
EUVD-2006-3796- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pg4x-mm39-59q8 No score
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows...
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
- Record
GHSA-pg4x-mm39-59q8- Updated
- 2026-11-02
OSV No score
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
- Record
CVE-2006-3802- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-3802 No score
Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 allows remote attackers to hijack native DOM methods from objects in another domain and conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object.
- Record
DEBIAN-CVE-2006-3802- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 |
before 1.5.0.5-1 | 1.5.0.5-1 |
thunderbirdDebian:13 |
before 1.5.0.5-1 | 1.5.0.5-1 |
thunderbirdDebian:14 |
before 1.5.0.5-1 | 1.5.0.5-1 |
seamonkeyRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-chatRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-develRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-mailRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
Show 93 moreShow less
| Package | Affected | Fixed |
|---|---|---|
seamonkey-nsprRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nssRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nss-develRed Hat:enterprise_linux:3::as From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkeyRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-chatRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-develRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-mailRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nsprRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nssRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nss-develRed Hat:enterprise_linux:3::desktop From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkeyRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-chatRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-develRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-mailRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nsprRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nssRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nss-develRed Hat:enterprise_linux:3::es From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkeyRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-chatRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-develRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-mailRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nsprRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nssRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
seamonkey-nss-develRed Hat:enterprise_linux:3::ws From an advisory covering 14 CVEs |
before 0:1.0.3-0.el3.1 | 0:1.0.3-0.el3.1 |
devhelpRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-develRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
seamonkeyRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-chatRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-develRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-mailRed Hat:enterprise_linux:4::as From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
devhelpRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-develRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
seamonkeyRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-chatRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-develRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-mailRed Hat:enterprise_linux:4::desktop From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
devhelpRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-develRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
seamonkeyRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-chatRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-develRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-mailRed Hat:enterprise_linux:4::es From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
devhelpRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
devhelp-develRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:0.10-0.2.el4 | 0:0.10-0.2.el4 |
seamonkeyRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-chatRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-develRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
seamonkey-mailRed Hat:enterprise_linux:4::ws From an advisory covering 26 CVEs |
before 0:1.0.3-0.el4.1 | 0:1.0.3-0.el4.1 |
firefoxRed Hat:enterprise_linux:4::as From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
firefox-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
firefoxRed Hat:enterprise_linux:4::desktop From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
firefox-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
firefoxRed Hat:enterprise_linux:4::es From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
firefox-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
firefoxRed Hat:enterprise_linux:4::ws From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
firefox-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 24 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbirdRed Hat:enterprise_linux:4::as From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbirdRed Hat:enterprise_linux:4::desktop From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbirdRed Hat:enterprise_linux:4::es From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbirdRed Hat:enterprise_linux:4::ws From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 25 CVEs |
before 0:1.5.0.5-0.el4.1 | 0:1.5.0.5-0.el4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3802 is a medium vulnerability (CVSS 5.8) in Mozilla Firefox, published July 27, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.36%, the 83rd percentile. Fixed in thunderbird 1.5.0.5-1.
References
secunia.com/advisories/21243
redhat.com/support/errata/RHSA-2006-0608.html
security.gentoo.org/glsa/glsa-200608-02.xml
mandriva.com/security/advisories?name=MDKSA-2006:145
vupen.com/english/advisories/2006/3748
securityfocus.com/bid/19181
Show 173 moreShow less
gentoo.org/security/en/glsa/glsa-200608-03.xml
securitytracker.com/id?1016588
usn.ubuntu.com/329-1
rhn.redhat.com/errata/RHSA-2006-0609.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9611
mozilla.org/security/announce/2006/mfsa2006-47.html
novell.com/linux/security/advisories/2006_48_seamonkey.html
exchange.xforce.ibmcloud.com/vulnerabilities/27983
ubuntu.com/usn/usn-350-1
issues.rpath.com/browse/RPL-536
nvd.nist.gov/vuln/detail/CVE-2006-3802
github.com/advisories/GHSA-pg4x-mm39-59q8
security-tracker.debian.org/tracker/CVE-2006-3802
access.redhat.com/errata/RHSA-2006:0608
bugzilla.redhat.com/show_bug.cgi?id=200253
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0608.json
cve.org/CVERecord?id=CVE-2006-3113