CVE-2006-4570
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows...
2.6 LowFix available
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
Exploit likelihood
2.44%Down 1.5 points since Feb 4, 2022
What each source reports
NVD Score used
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
CVE-2006-4570- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
CVE-2006-4570- Updated
- 2026-11-02
EUVDEUVD-2006-4558No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
EUVD-2006-4558- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23g7-p8vx-g5m2No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows...
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
GHSA-23g7-p8vx-g5m2- Updated
- 2026-11-02
OSVNo score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
CVE-2006-4570- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-4570No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
DEBIAN-CVE-2006-4570- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 | before 1.5.0.7-1 | 1.5.0.7-1 |
thunderbirdDebian:13 | before 1.5.0.7-1 | 1.5.0.7-1 |
thunderbirdDebian:14 | before 1.5.0.7-1 | 1.5.0.7-1 |
mozilla-thunderbirdDebian:3.1 From an advisory covering 7 CVEs | before 1.0.2-2.sarge1.0.8c.1, plus listed versions 1.0.2-21.0.2-2.sarge1.0.61.0.2-2.sarge1.0.71.0.2-2.sarge1.0.81.0.2-2.sarge1.0.8a1.0.2-2.sarge1.0.8b.11.0.2-2.sarge1.0.8b.2 | 1.0.2-2.sarge1.0.8c.1 |
mozillaDebian:3.1 From an advisory covering 7 CVEs | before 2:1.7.8-1sarge7.3.1, plus listed versions 2:1.7.8-12:1.7.8-1sarge12:1.7.8-1sarge22:1.7.8-1sarge32:1.7.8-1sarge5 Show 5 moreShow less2:1.7.8-1sarge62:1.7.8-1sarge72:1.7.8-1sarge7.12:1.7.8-1sarge7.2.12:1.7.8-1sarge7.2.2 | 2:1.7.8-1sarge7.3.1 |
seamonkeyRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
Show 87 moreShow less
| Package | Affected | Fixed |
|---|---|---|
seamonkey-js-debuggerRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkeyRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkeyRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkeyRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
devhelpRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
devhelpRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
devhelpRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
devhelpRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 7 CVEs | before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4570 is a low vulnerability (CVSS 2.6) in Mozilla Seamonkey, published September 15, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in thunderbird 1.5.0.7-1.
References
secunia.com/advisories/22391
redhat.com/support/errata/RHSA-2006-0676.html
mozilla.org/security/announce/2006/mfsa2006-63.html
ubuntu.com/usn/usn-361-1
Show 67 moreShow less
securitytracker.com/id?1016867
us.debian.org/security/2006/dsa-1191
security.gentoo.org/glsa/glsa-200610-04.xml
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10892
debian.org/security/2006/dsa-1192
securityfocus.com/bid/20042
exchange.xforce.ibmcloud.com/vulnerabilities/28962
novell.com/linux/security/advisories/2006_54_mozilla.html
mandriva.com/security/advisories?name=MDKSA-2006:169
nvd.nist.gov/vuln/detail/CVE-2006-4570
github.com/advisories/GHSA-23g7-p8vx-g5m2
security-tracker.debian.org/tracker/CVE-2006-4570
access.redhat.com/errata/RHSA-2006:0676
bugzilla.redhat.com/show_bug.cgi?id=206429
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0676.json
cve.org/CVERecord?id=CVE-2006-4253