CVE-2006-0298

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

The XML parser in Mozilla Firefox before 1.5.0.1 and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly read sensitive data via unknown attack vectors that trigger an out-of-bounds read.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:N/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/18700Patch, Vendor Advisory
http://secunia.com/advisories/18704Patch, Vendor Advisory
http://secunia.com/advisories/22065Vendor Advisory
http://securitytracker.com/id?1015570Patch
http://www.mozilla.org/security/announce/2006/mfsa2006-07.html
http://www.securityfocus.com/archive/1/446657/100/200/threaded
http://www.securityfocus.com/bid/16476Exploit, Patch
http://www.vupen.com/english/advisories/2006/0413Vendor Advisory
http://www.vupen.com/english/advisories/2006/3749Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24436
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A677
http://secunia.com/advisories/18700Patch, Vendor Advisory
http://secunia.com/advisories/18704Patch, Vendor Advisory
http://secunia.com/advisories/22065Vendor Advisory
http://securitytracker.com/id?1015570Patch
http://www.mozilla.org/security/announce/2006/mfsa2006-07.html
http://www.securityfocus.com/archive/1/446657/100/200/threaded
http://www.securityfocus.com/bid/16476Exploit, Patch
http://www.vupen.com/english/advisories/2006/0413Vendor Advisory
http://www.vupen.com/english/advisories/2006/3749Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24436
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A677

Timeline

Published: Feb 2, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-02996.4The E4X implementation in Mozilla Firefox before 1.5.0.1, Thunderbird 1.5 if running Javascript in mail, and SeaMonkey before 1.0 exposes th CVE-2006-03005.1Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly exe CVE-2006-03017.5Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framew CVE-2006-03025.0ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC addr CVE-2006-030310.0Multiple unspecified vulnerabilities in the (1) publishing component, (2) Contact Component, (3) TinyMCE Compressor, and (4) other component CVE-2006-03047.5Buffer overflow in Dual DHCP DNS Server 1.0 allows remote attackers to cause a denial of service (application crash) and possibly execute ar CVE-2006-03057.5Clipcomm CPW-100E VoIP 802.11b Wireless Handset Phone running firmware 1.1.12 (051129) and CP-100E VoIP 802.11b Wireless Phone running firmw CVE-2006-03065.0The DM Primer (dmprimer.exe) in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARC CVE-2006-03075.0The DM Primer in the DM Deployment Common Component in Computer Associates (CA) BrightStor Mobile Backup r4.0, BrightStor ARCserve Backup fo CVE-2006-03087.5PHP remote file inclusion vulnerability in htmltonuke.php in the htmltonuke 2.0 alpha, and possibly other versions, module for PHP-Nuke allo CVE-2006-03094.0Linksys BEFVP41 VPN Router 2.0 with firmware 1.01.04 allows remote attackers on the local network, to cause a denial of service via IP packe CVE-2006-03104.3Cross-site scripting (XSS) vulnerability in aoblogger 2.3 allows remote attackers to inject arbitrary Javascript via a javascript URI in the