Skip to content
OpenAdvisories
Unscored Public exploit CVE-2006-2894 EUVD-2006-2891GHSA-gjhw-j84v-5cmv

Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape …

Published Jun 7, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 5.0 iceape 1.0.11~pre071022-0etch1+lenny1 DTSA-80-1
Debian 5.0 xulrunner 1.8.0.14~pre071019b-0lenny1 DTSA-69-1
Debian 4.0 iceape 1.0.11~pre071022-0etch1 DSA-1401-1
Debian 4.0 xulrunner 1.8.0.14~pre071019b-0etch1 DSA-1392-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 2

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 4

References