4

CVE-2006-2894

Exploit
Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version <= 2.0.0.8
Mozilla ≫ Firefox Version1.5.0.4
Mozilla ≫ Mozilla Suite Version1.7.13
Mozilla ≫ Seamonkey Version <= 1.1.4
Mozilla ≫ Seamonkey Version1.0.2
Netscape ≫ Navigator Version <= 8.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.83% 0.95
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4 4.9 4.9
AV:N/AC:H/Au:N/C:P/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.vupen.com/english/advisories/2008/0083
Vendor Advisory
http://secunia.com/advisories/21532
Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:143
http://www.mandriva.com/security/advisories?name=MDKSA-2006:145
http://archives.neohapsis.com/archives/bugtraq/2007-02/0166.html
http://archives.neohapsis.com/archives/bugtraq/2007-02/0187.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://lcamtuf.coredump.cx/focusbug/
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
Exploit
http://lists.virus.org/full-disclosure-0702/msg00225.html
http://secunia.com/advisories/20442
Vendor Advisory
http://secunia.com/advisories/20467
Vendor Advisory
http://secunia.com/advisories/20470
Vendor Advisory
http://secunia.com/advisories/20472
Vendor Advisory
http://secunia.com/advisories/27298
Vendor Advisory
http://secunia.com/advisories/27335
Vendor Advisory
http://secunia.com/advisories/27383
Vendor Advisory
http://secunia.com/advisories/27387
Vendor Advisory
http://secunia.com/advisories/27403
Vendor Advisory
http://secunia.com/advisories/27414
Vendor Advisory
http://securityreason.com/securityalert/1059
http://securitytracker.com/id?1018837
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
http://www.gnucitizen.org/blog/browser-focus-rip
http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.novell.com/linux/security/advisories/2007_57_mozilla.html
http://www.securityfocus.com/archive/1/482876/100/200/threaded
http://www.securityfocus.com/archive/1/482925/100/0/threaded
http://www.securityfocus.com/archive/1/482932/100/200/threaded
http://www.securityfocus.com/bid/18308
http://www.thanhngan.org/fflinuxversion.html
http://www.ubuntu.com/usn/usn-536-1
http://www.vupen.com/english/advisories/2006/2160
Vendor Advisory
http://www.vupen.com/english/advisories/2006/2162
Vendor Advisory
http://www.vupen.com/english/advisories/2006/2163
Vendor Advisory
http://www.vupen.com/english/advisories/2006/2164
Vendor Advisory
http://www.vupen.com/english/advisories/2007/3544
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=290478
https://bugzilla.mozilla.org/show_bug.cgi?id=370092
https://bugzilla.mozilla.org/show_bug.cgi?id=56236
https://issues.rpath.com/browse/RPL-1858
https://usn.ubuntu.com/535-1/
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html