CVE-2006-5462

NameCVE-2006-5462
DescriptionMozilla Network Security Service (NSS) library before 3.11.3, as used in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, when using an RSA key with exponent 3, does not properly handle extra data in a signature, which allows remote attackers to forge signatures for SSL/TLS and email certificates. NOTE: this identifier is for unpatched product versions that were originally intended to be addressed by CVE-2006-4340.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1224-1, DSA-1225-1, DSA-1227-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firefox (PTS)sid126.0-1fixed
firefox-esr (PTS)jessie, jessie (lts)68.9.0esr-1~deb8u2fixed
stretch (security), stretch (lts), stretch91.11.0esr-1~deb9u1fixed
buster91.12.0esr-1~deb10u1fixed
buster (security)115.11.0esr-1~deb10u1fixed
bullseye115.7.0esr-1~deb11u1fixed
bullseye (security)115.11.0esr-1~deb11u1fixed
bookworm115.7.0esr-1~deb12u1fixed
bookworm (security)115.11.0esr-1~deb12u1fixed
sid, trixie115.11.0esr-1fixed
icedove (PTS)jessie1:52.3.0-4~deb8u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)45.0-1high
firefox-esrsource(unstable)45.0esr-1high
icedovesource(unstable)1.5.0.8-1medium
iceweaselsource(unstable)2.0+dfsg-1high
mozillasourcesarge2:1.7.8-1sarge8DSA-1224-1
mozillasource(unstable)(unfixed)high
mozilla-firefoxsourcesarge1.0.4-2sarge13DSA-1225-1
mozilla-thunderbirdsourcesarge1.0.2-2.sarge1.0.8d.1DSA-1227-1
xulrunnersource(unstable)1.8.0.8-1high

Notes

MFSA-2006-66
this is the similar to CVE-2006-4339, see also CVE-2006-4340
the fixes for CVE-2006-4340 were incomplete

Search for package or bug name: Reporting problems