CVE-2006-1729

Name	CVE-2006-1729
Description	Mozilla Firefox 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to read arbitrary files by (1) inserting the target filename into a text box, then turning that box into a file upload control, or (2) changing the type of the input control that is associated with an event handler.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1044-1, DSA-1046-1, DSA-1051-1, DSA-1134-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	132.0.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
firefox	source	(unstable)	1.5.dfsg+1.5.0.2-1	medium
mozilla	source	sarge	2:1.7.8-1sarge5		DSA-1046-1
mozilla	source	(unstable)	2:1.7.13-0.1	medium
mozilla-firefox	source	sarge	1.0.4-2sarge6		DSA-1044-1
mozilla-firefox	source	(unstable)	1.5.dfsg+1.5.0.2-1	medium
mozilla-thunderbird	source	sarge	1.0.2-2.sarge1.0.8a		DSA-1134-1
xulrunner	source	(unstable)	1.8.0.1-9

Can likely be used to steal OpenSSH keys and the like.