Unscored severity · published Sep 15, 2006
CVE-2006-4340
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339. NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefox · Mozilla
through 1.5.0.6 · source: NVD
NS
Network Security Services · Mozilla
through 3.11.2 · source: NVD
SE
Seamonkey · Mozilla
through 1.0.4 · source: NVD
TH
Thunderbird · Mozilla
through 1.5.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4340
Vendor Advisory
http://secunia.com/advisories/21903
Patch
http://secunia.com/advisories/21906
Vendor Advisory
http://secunia.com/advisories/21915
Vendor Advisory
http://secunia.com/advisories/21916
Vendor Advisory
http://secunia.com/advisories/21939
More from Firefox
10.0
CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
9.8
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
9.8
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
9.6
CVE-2022-26486
Mozilla Firefox Use-After-Free Vulnerability
8.8
CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability