CVE-2006-4570
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows...
2.6 LowFix available
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
Exploit likelihood
2.44%Down 1.5 points since Feb 4, 2022
What each source reports
NVD Score used
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
CVE-2006-4570- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
CVE-2006-4570- Updated
- 2026-11-02
EUVDEUVD-2006-4558 No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
EUVD-2006-4558- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-23g7-p8vx-g5m2 No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows...
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
GHSA-23g7-p8vx-g5m2- Updated
- 2026-11-02
OSV No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
CVE-2006-4570- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-4570 No score
Mozilla Thunderbird before 1.5.0.7 and SeaMonkey before 1.0.5, with "Load Images" enabled, allows remote user-assisted attackers to bypass settings that disable JavaScript via a remote XBL file in a message that is loaded when the user views, forwards, or replies to the original message.
- Record
DEBIAN-CVE-2006-4570- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 |
before 1.5.0.7-1 | 1.5.0.7-1 |
thunderbirdDebian:13 |
before 1.5.0.7-1 | 1.5.0.7-1 |
thunderbirdDebian:14 |
before 1.5.0.7-1 | 1.5.0.7-1 |
mozilla-thunderbirdDebian:3.1 |
before 1.0.2-2.sarge1.0.8c.1, plus listed versions 1.0.2-21.0.2-2.sarge1.0.61.0.2-2.sarge1.0.71.0.2-2.sarge1.0.81.0.2-2.sarge1.0.8a1.0.2-2.sarge1.0.8b.11.0.2-2.sarge1.0.8b.2 |
1.0.2-2.sarge1.0.8c.1 |
mozillaDebian:3.1 |
before 2:1.7.8-1sarge7.3.1, plus listed versions 2:1.7.8-12:1.7.8-1sarge12:1.7.8-1sarge22:1.7.8-1sarge32:1.7.8-1sarge5 Show 5 moreShow less2:1.7.8-1sarge62:1.7.8-1sarge72:1.7.8-1sarge7.12:1.7.8-1sarge7.2.12:1.7.8-1sarge7.2.2 |
2:1.7.8-1sarge7.3.1 |
seamonkeyRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
Show 87 moreShow less
| Package | Affected | Fixed |
|---|---|---|
seamonkey-js-debuggerRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::as |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkeyRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkeyRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::es |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkeyRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-chatRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-js-debuggerRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-mailRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nsprRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nspr-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nssRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
seamonkey-nss-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.5-0.1.el3 | 0:1.0.5-0.1.el3 |
devhelpRed Hat:enterprise_linux:4::as |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::as |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::as |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::as |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::as |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::as |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::as |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::as |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::as |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
devhelpRed Hat:enterprise_linux:4::desktop |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::desktop |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::desktop |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::desktop |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::desktop |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::desktop |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::desktop |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::desktop |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
devhelpRed Hat:enterprise_linux:4::es |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::es |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::es |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::es |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::es |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::es |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::es |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::es |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::es |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
devhelpRed Hat:enterprise_linux:4::ws |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
devhelp-develRed Hat:enterprise_linux:4::ws |
before 0:0.10-0.4.el4 | 0:0.10-0.4.el4 |
seamonkeyRed Hat:enterprise_linux:4::ws |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-chatRed Hat:enterprise_linux:4::ws |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-develRed Hat:enterprise_linux:4::ws |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-dom-inspectorRed Hat:enterprise_linux:4::ws |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-js-debuggerRed Hat:enterprise_linux:4::ws |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
seamonkey-mailRed Hat:enterprise_linux:4::ws |
before 0:1.0.5-0.1.el4 | 0:1.0.5-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::as |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::desktop |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::es |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbirdRed Hat:enterprise_linux:4::ws |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
thunderbird-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.5.0.7-0.1.el4 | 0:1.5.0.7-0.1.el4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4570 is a low vulnerability (CVSS 2.6) in Mozilla Seamonkey, published September 15, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in thunderbird 1.5.0.7-1.
References
secunia.com/advisories/22391
redhat.com/support/errata/RHSA-2006-0676.html
mozilla.org/security/announce/2006/mfsa2006-63.html
ubuntu.com/usn/usn-361-1
Show 67 moreShow less
securitytracker.com/id?1016867
us.debian.org/security/2006/dsa-1191
security.gentoo.org/glsa/glsa-200610-04.xml
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10892
debian.org/security/2006/dsa-1192
securityfocus.com/bid/20042
exchange.xforce.ibmcloud.com/vulnerabilities/28962
novell.com/linux/security/advisories/2006_54_mozilla.html
mandriva.com/security/advisories?name=MDKSA-2006:169
nvd.nist.gov/vuln/detail/CVE-2006-4570
github.com/advisories/GHSA-23g7-p8vx-g5m2
security-tracker.debian.org/tracker/CVE-2006-4570
access.redhat.com/errata/RHSA-2006:0676
bugzilla.redhat.com/show_bug.cgi?id=206429
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0676.json
cve.org/CVERecord?id=CVE-2006-4253