CVE-2006-2783

Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark (BOM) from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2006-06-02

Last modified

2024-08-07

Weaknesses

CWE-79

Affected products

• Firefox (Mozilla)
• Thunderbird (Mozilla)

References

• http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
• http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
• http://rhn.redhat.com/errata/RHSA-2006-0609.html
• http://secunia.com/advisories/20376
• http://secunia.com/advisories/20382
• http://secunia.com/advisories/20561
• http://secunia.com/advisories/20709
• http://secunia.com/advisories/21134
• http://secunia.com/advisories/21176
• http://secunia.com/advisories/21178
• http://secunia.com/advisories/21183
• http://secunia.com/advisories/21188
• http://secunia.com/advisories/21210
• http://secunia.com/advisories/21269
• http://secunia.com/advisories/21270
• http://secunia.com/advisories/21324
• http://secunia.com/advisories/21336
• http://secunia.com/advisories/21532
• http://secunia.com/advisories/21607
• http://secunia.com/advisories/21631
• http://secunia.com/advisories/22065
• http://secunia.com/advisories/22066
• http://secunia.com/advisories/31074
• http://secunia.com/advisories/35379
• http://securitytracker.com/id?1016202
• http://securitytracker.com/id?1016214
• http://support.apple.com/kb/HT3613
• http://www.debian.org/security/2006/dsa-1118
• http://www.debian.org/security/2006/dsa-1120
• http://www.debian.org/security/2006/dsa-1134