{"id":"CVE-2006-1942","aliases":["DSA-1118","DSA-1120","DSA-1134-1","EUVD-2006-1942","GHSA-xp4w-9xx2-8w32"],"status":"published","title":"Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2,...","description":"Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an \"alternate web page.\"","severity":{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02597,"percentile":0.85459,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2006-04-20T22:00:00Z","modified":"2026-06-16T22:23:59Z","affected":[{"source":"osv","ecosystem":"Debian:3.1","package":"mozilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.8-1sarge7.1"}]}],"versions":["2:1.7.8-1","2:1.7.8-1sarge1","2:1.7.8-1sarge2","2:1.7.8-1sarge3","2:1.7.8-1sarge5","2:1.7.8-1sarge6","2:1.7.8-1sarge7"],"bundled":14},{"source":"osv","ecosystem":"Debian:3.1","package":"mozilla-firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-2sarge9"}]}],"versions":["1.0.4-2","1.0.4-2sarge1","1.0.4-2sarge2","1.0.4-2sarge3","1.0.4-2sarge4","1.0.4-2sarge5","1.0.4-2sarge6","1.0.4-2sarge7"],"bundled":13},{"source":"osv","ecosystem":"Debian:3.1","package":"mozilla-thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2.sarge1.0.8a"}]}],"versions":["1.0.2-2","1.0.2-2.sarge1.0.6","1.0.2-2.sarge1.0.7","1.0.2-2.sarge1.0.8"],"bundled":15}],"products":[{"vendor":"k-meleon_project","product":"k-meleon"},{"vendor":"mozilla","product":"firefox"},{"vendor":"netscape","product":"navigator"}],"references":[{"url":"http://secunia.com/advisories/21176","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2006/3748","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory"]},{"url":"http://www.osvdb.org/24713","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://secunia.com/advisories/19698","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/431267/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/20063","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.mozilla.org/security/announce/2006/mfsa2006-39.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25925","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/433138/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.networksecurity.fi/advisories/netscape-view-image.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/435795/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/20376","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://securitytracker.com/id?1016202","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/18228","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2008/0083","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/446658/100/200/threaded","tags":["vendor-advisory","x_refsource_HP","x_transferred"]},{"url":"http://www.debian.org/security/2006/dsa-1118","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.debian.org/security/2006/dsa-1120","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/19988","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.gavinsharp.com/tmp/ImageVuln.html","tags":["x_refsource_MISC","x_transferred","Patch"]},{"url":"http://www.debian.org/security/2006/dsa-1134","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/21324","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/21183","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=334341","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/22066","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.novell.com/linux/security/advisories/2006_35_mozilla.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2006/2106","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/433539/30/5070/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-1942"},{"url":"https://github.com/advisories/GHSA-xp4w-9xx2-8w32"}],"sources":{"cve":[{"id":"CVE-2006-1942","description":"Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an \"alternate web page.\"","status":"published","published":"2006-04-20T22:00:00Z","modified":"2024-08-07T17:27:29.865Z","updated_at":"2026-11-02T14:33:51.470623Z"}],"euvd":[{"id":"EUVD-2006-1942","description":"Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an \"alternate web page.\"","status":"published","published":"2006-04-20T22:00:00Z","modified":"2024-08-07T17:27:29Z","updated_at":"2026-11-03T01:16:03.203363Z"}],"ghsa":[{"id":"GHSA-xp4w-9xx2-8w32","title":"Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2,...","description":"Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an \"alternate web page.\"","status":"published","published":"2022-05-01T06:54:26Z","modified":"2023-01-31T05:01:07Z","updated_at":"2026-11-02T14:47:59.599725Z"}],"nvd":[{"id":"CVE-2006-1942","description":"Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, Netscape 8.1, 8.0.4, and 7.2, and K-Meleon 0.9.13 allows user-assisted remote attackers to open local files via a web page with an IMG element containing a SRC attribute with a non-image file:// URL, then tricking the user into selecting View Image for the broken image, as demonstrated using a .wma file to launch Windows Media Player, or by referencing an \"alternate web page.\"","status":"published","published":"2006-04-20T22:02:00Z","modified":"2026-06-16T22:23:59.46Z","cvss":[{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:02.433957Z"}],"osv":[{"id":"DSA-1118","title":"mozilla - several","status":"published","published":"2006-07-22T00:00:00Z","modified":"2026-03-09T01:01:29.264402Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"DSA-1120","title":"mozilla-firefox - several vulnerabilities","status":"published","published":"2006-07-23T00:00:00Z","modified":"2026-03-09T01:01:43.074547Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"DSA-1134-1","title":"mozilla-thunderbird - several vulnerabilities","status":"published","published":"2006-08-02T00:00:00Z","modified":"2026-03-09T01:01:04.335335Z","updated_at":"2026-11-02T15:46:14.285228Z"}]}}