Mozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, and SeaMonkey before 1.0.5, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates, a similar vulnerability to CVE-2006-4339. NOTE: on 20061107, Mozilla released an advisory stating that these versions were not completely patched by MFSA2006-60. The newer fixes for 1.5.0.7 are covered by CVE-2006-5462.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade thunderbird | Jul 30, 2024 | Sep 15, 2006 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefoxUpgrade linux-thunderbirdUpgrade linux-seamonkeyUpgrade mozillaUpgrade linux-firefox-develUpgrade seamonkeyUpgrade mozilla-thunderbirdUpgrade linux-seamonkey-develUpgrade linux-mozilla-develUpgrade linux-firefoxUpgrade linux-mozilla | Dec 10, 2025 | Sep 15, 2006 |
| Gentoo Linux | — | Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade dev-libs/nss.Upgrade www-client/mozilla-firefox-bin. | Oct 30, 2017 | Sep 15, 2006 |
| Mfsa2006 60 | — | Upgrade to Mozilla Firefox version 1.5.0.7 | Jun 14, 2012 | Sep 15, 2006 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.0.5 | Feb 3, 2012 | Sep 15, 2006 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 1.5.0.7 | Feb 22, 2012 | Sep 15, 2006 |
| Suse | — | Upgrade mozilla-nss-develUpgrade sax2-libsaxUpgrade openmotif-devel-64bitUpgrade sax2-libsax-csharpUpgrade sax2-libsax-develUpgrade openmotif-demoUpgrade desktop-data-NLDUpgrade yast2-qtUpgrade xorg-x11-driver-videoUpgrade mozilla-nss-toolsUpgrade dejavuUpgrade MozillaFirefoxUpgrade MozillaFirefox-translationsUpgrade sax2-toolsUpgrade openmotif-libs-64bitUpgrade mozilla-nss-32bitUpgrade openmotif-libsUpgrade openmotifUpgrade sax2Upgrade mozilla-nss-x86Upgrade yast2-x11Upgrade openmotif-develUpgrade sax2-libsax-perlUpgrade sax2-libsax-javaUpgrade sax2-guiUpgrade sax2-identUpgrade mozilla-nssUpgrade xorg-x11-driver-video-nvidiaUpgrade yast2-control-centerUpgrade openmotif-devel-32bitUpgrade tightvncUpgrade openmotif-libs-32bitUpgrade openmotif-libs-x86Upgrade mozilla-nss-64bitUpgrade xdg-menuUpgrade sax2-libsax-python | Feb 17, 2015 | Sep 15, 2006 |
| Ubuntu | — | Upgrade mozilla-thunderbird-locale-ukUpgrade mozilla-thunderbird-enigmailUpgrade libnspr4Upgrade mozilla-thunderbird-locale-frUpgrade mozilla-thunderbird-typeaheadfindUpgrade firefoxUpgrade mozilla-thunderbird-locale-deUpgrade mozilla-psmUpgrade mozilla-thunderbird-locale-caUpgrade mozilla-thunderbird-locale-itUpgrade mozilla-thunderbird-locale-nlUpgrade libnss3Upgrade mozilla-browserUpgrade mozilla-mailnewsUpgrade mozilla-thunderbird-inspectorUpgrade mozilla-thunderbirdUpgrade mozilla-thunderbird-locale-pl | Nov 8, 2024 | Sep 15, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub