$ cve CVE-2006-1993 JSON

CVE-2006-1993 EXPLOIT

5.1

MEDIUM · CVSS 2.0 · EPSS 54% (pctl 99)

Patch early

A public exploit exists.

Description

Mozilla Firefox 1.5.0.2, when designMode is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via certain Javascript that is not properly handled by the contentWindow.focus method in an iframe, which causes a reference to a deleted controller context object. NOTE: this was originally claimed to be a buffer overflow in (1) js320.dll and (2) xpcom_core.dll, but the vendor disputes this claim.

Scoring

CVSS	5.1 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS	54% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-399
On CISA KEV	no
Public exploit	yes
Published	2006-04-25
Last modified	2026-06-16

Affected (1)

Vendor	Product
mozilla	firefox

Public exploits

Source	Title	Date
exploit-db	Mozilla Firefox 1.5.0.2 - 'js320.dll/xpcom_core.dll' Denial of Service (PoC)	2006-04-24

References

→ the Explorer · watch your stack · NVD