CVE-2006-1993

Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of...

5.1 MediumPublic exploitFix available

Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.

Exploit likelihood

54.0%Up 8.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.1

Record: CVE-2006-1993
CVSS 2.0: 5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-1993
Updated: 2026-11-02

EUVDEUVD-2006-1993 No score

Record: EUVD-2006-1993
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gh5c-2j93-h8q7 No score

Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of...

Record: GHSA-gh5c-2j93-h8q7
Updated: 2026-11-02

Affected products

mozilla firefox

Affected packages

Affected packages
Package	Affected	Fixed
`mozilla` Debian:3.1	before 2:1.7.8-1sarge6, plus listed versions 2:1.7.8-12:1.7.8-1sarge12:1.7.8-1sarge22:1.7.8-1sarge32:1.7.8-1sarge5	2:1.7.8-1sarge6
`mozilla-firefox` Debian:3.1	before 1.0.4-2sarge7, plus listed versions 1.0.4-21.0.4-2sarge11.0.4-2sarge21.0.4-2sarge31.0.4-2sarge41.0.4-2sarge51.0.4-2sarge6	1.0.4-2sarge7

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Mozilla Firefox 1.5.0.2 - 'js320.dll/xpcom_core.dll' Denial of Service (PoC)	2006-04-24

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-1993 is a medium vulnerability (CVSS 5.1) in Mozilla Firefox, published April 25, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 54.0%, the 99th percentile. Fixed in mozilla 2:1.7.8-1sarge6.

References

Show 20 moreShow less