Vulnerability record · CVE-2006-0295 · published 2 February 2006
CVE-2006-0295: Mozilla Firefox, Thunderbird and SeaMonkey memory corruption via QueryInterface
Mozilla · Firefox
A memory corruption flaw exists in Mozilla Firefox 1.5, Thunderbird 1.5 (when JavaScript is enabled in mail) and SeaMonkey before 1.0, reachable through the QueryInterface method of the built-in Location and Navigator objects. A remote attacker could potentially execute arbitrary code in the context of the affected application. The record does not specify affected point versions beyond these ranges.
Description
Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the QueryInterface method of the built-in Location and Navigator objects, which leads to memory corruption.
AV:N/AC:H/Au:N/C:P/I:P/A:P
Automated analysis
medium priorityCVSS 2.0 rates this MEDIUM (5.1) with high access complexity, but the high EPSS percentile and potential for arbitrary code execution warrant attention, especially on unpatched legacy Mozilla installations.
What it is
A memory corruption flaw exists in Mozilla Firefox 1.5, Thunderbird 1.5 (when JavaScript is enabled in mail) and SeaMonkey before 1.0, reachable through the QueryInterface method of the built-in Location and Navigator objects. A remote attacker could potentially execute arbitrary code in the context of the affected application. The record does not specify affected point versions beyond these ranges.
Impact
An attacker who can get the vulnerable code path executed may achieve arbitrary code execution with the privileges of the browser or mail client. This could lead to full compromise of the user's session and data.
Attack surface
The flaw is network-reachable (AV:N) and requires no authentication (Au:N), but the CVSS vector rates access complexity as high (AC:H), implying a specific or difficult-to-arrange condition must be met. User interaction is not explicitly stated in the record, but typical browser/mail JavaScript execution implies the victim must load attacker-controlled content.
Exploitation
CVE-2006-0295 is not listed in CISA KEV and no ransomware groups are documented using it. EPSS shows a 30-day probability of 0.71311 (99.38th percentile), indicating a high modeled likelihood of exploitation activity, though the record contains no public exploit references or tags confirming in-the-wild use.
What to do
- Upgrade to a fixed Mozilla release as referenced in the vendor advisory (mfsa2006-04) and Bugzilla patch.
- Disable JavaScript in Thunderbird mail if the product cannot be immediately updated.
- Restrict or block untrusted web and email content that can invoke the affected Location and Navigator objects.
- Apply vendor and US-CERT guidance from the referenced advisories to affected Firefox, Thunderbird and SeaMonkey installations.
Detection
- Monitor for crashes or abnormal termination of Firefox, Thunderbird or SeaMonkey processes that correlate with visits to untrusted content.
- Hunt for suspicious child processes or unexpected code execution spawned from browser or mail client processes.
- Review endpoint logs for exploitation attempts targeting Mozilla products around the publication window and later.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-0295 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-0295), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
