CVE-2006-2775
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under...
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
Exploit likelihood
What each source reports
NVD Score used
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
CVE-2006-2775- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
CVE-2006-2775- Updated
- 2026-11-02
EUVDEUVD-2006-2772 No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
EUVD-2006-2772- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vvv2-hwwj-rm5q No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under...
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
GHSA-vvv2-hwwj-rm5q- Updated
- 2026-11-02
OSV No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
CVE-2006-2775- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-2775 No score
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
- Record
DEBIAN-CVE-2006-2775- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 |
before 1.5.0.4-1 | 1.5.0.4-1 |
thunderbirdDebian:13 |
before 1.5.0.4-1 | 1.5.0.4-1 |
thunderbirdDebian:14 |
before 1.5.0.4-1 | 1.5.0.4-1 |
mozillaDebian:3.1 From an advisory covering 14 CVEs |
before 2:1.7.8-1sarge7.1, plus listed versions 2:1.7.8-12:1.7.8-1sarge12:1.7.8-1sarge22:1.7.8-1sarge32:1.7.8-1sarge52:1.7.8-1sarge62:1.7.8-1sarge7 |
2:1.7.8-1sarge7.1 |
mozilla-firefoxDebian:3.1 From an advisory covering 13 CVEs |
before 1.0.4-2sarge9, plus listed versions 1.0.4-21.0.4-2sarge11.0.4-2sarge21.0.4-2sarge31.0.4-2sarge41.0.4-2sarge51.0.4-2sarge61.0.4-2sarge7 |
1.0.4-2sarge9 |
mozilla-thunderbirdDebian:3.1 From an advisory covering 15 CVEs |
before 1.0.2-2.sarge1.0.8a, plus listed versions 1.0.2-21.0.2-2.sarge1.0.61.0.2-2.sarge1.0.71.0.2-2.sarge1.0.8 |
1.0.2-2.sarge1.0.8a |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2775 is a high vulnerability (CVSS 7.5) in Mozilla Firefox, published June 2, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.57%, the 91st percentile. Fixed in thunderbird 1.5.0.4-1.
References
secunia.com/advisories/20709
mandriva.com/security/advisories?name=MDKSA-2006:145
vupen.com/english/advisories/2006/3748
usn.ubuntu.com/297-3
Show 39 moreShow less
mozilla.org/security/announce/2006/mfsa2006-35.html
us-cert.gov/cas/techalerts/TA06-153A.html
securitytracker.com/id?1016214
securityfocus.com/archive/1/435795/100/0/threaded
gentoo.org/security/en/glsa/glsa-200606-21.xml
debian.org/security/2006/dsa-1118
kb.cert.org/vuls/id/243153
novell.com/linux/security/advisories/2006_35_mozilla.html
exchange.xforce.ibmcloud.com/vulnerabilities/26846
nvd.nist.gov/vuln/detail/CVE-2006-2775
github.com/advisories/GHSA-vvv2-hwwj-rm5q
security-tracker.debian.org/tracker/CVE-2006-2775