Description
Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 45.0esr-1 | — |
| Debian 13 | firefox-esr | 45.0esr-1 | — |
| Debian 12 | firefox-esr | 45.0esr-1 | — |
| Debian 3.1 | mozilla | 2:1.7.8-1sarge8 | DSA-1224-1 |
| Debian 3.1 | mozilla-firefox | 1.0.4-2sarge13 | DSA-1225-1 |
| Debian 3.1 | mozilla-thunderbird | 1.0.2-2.sarge1.0.8d.1 | DSA-1227-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.10-0.5.el4 | RHSA-2006:0734 |
| RHEL 4 | firefox +1 | 1.5.0.8-0.1.el4 | RHSA-2006:0735, RHSA-2006:0733 |
| RHEL 4 | seamonkey +5 | 1.0.6-0.1.el4 | RHSA-2006:0734 |
| RHEL 3 | seamonkey +9 | 1.0.6-0.1.el3 | RHSA-2006:0734 |
| RHEL 2 | seamonkey +9 | 1.0.6-0.1.el2 | RHSA-2006:0734 |
Advisories 6
- RHSA-2006:0734 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0735 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0733 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1227-1 mozilla-thunderbird Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1225-1 mozilla-firefox Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1224-1 mozilla Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2006-3748 vdb-entry
- 23883 third-party-advisory
- 23235 third-party-advisory
- GLSA-200612-08 vendor-advisory
- 23013 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-246.htm
- 22770 third-party-advisory
- ADV-2006-4387 vdb-entry
- DSA-1225 vendor-advisory
- 1017180 vdb-entry
- 23009 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=356215
- TA06-312A third-party-advisory
- DSA-1227 vendor-advisory
- 22980 third-party-advisory
- ADV-2007-0293 vdb-entry
- RHSA-2006:0733 vendor-advisory
- 24711 third-party-advisory
- 23263 third-party-advisory
- 22763 third-party-advisory
- 22965 third-party-advisory
- USN-382-1 vendor-advisory
- ADV-2008-0083 vdb-entry
- RHSA-2006:0735 vendor-advisory
- 1017181 vdb-entry
- SUSE-SA:2006:068 vendor-advisory
- GLSA-200612-07 vendor-advisory
- ADV-2007-1198 vdb-entry
- 23297 third-party-advisory
- 22727 third-party-advisory
- 22815 third-party-advisory
- RHSA-2006:0734 vendor-advisory
- VU#335392 third-party-advisory
- SSRT061181 vendor-advisory
- mozilla-nss-security-bypass(30098) vdb-entry
- 22737 third-party-advisory
- 22929 third-party-advisory
- 23202 third-party-advisory
- GLSA-200612-06 vendor-advisory
- MDKSA-2006:206 vendor-advisory
- oval:org.mitre.oval:def:10478 vdb-entry signature
- 23197 third-party-advisory
- DSA-1224 vendor-advisory
- 22066 third-party-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-66.html
- 22817 third-party-advisory
- 22722 third-party-advisory
- 102781 vendor-advisory
- http://www.mozilla.org/security/announce/2006/mfsa2006-60.html
- 1017182 vdb-entry
- MDKSA-2006:205 vendor-advisory
- 23287 third-party-advisory
- USN-381-1 vendor-advisory