CVE:CVE-2006-2777
CNNVD:CNNVD-200606-054
Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla发布的WEB浏览器和邮件新闻组客户端产品。
Web内容可以访问Selection对象的nsISelectionPrivate接口并用于添加SelectionListener。当用户在页面上执行"查找"或"全选"操作时会调用监听程序。如果结合其他漏洞的话攻击者就可以在特权环境中执行任意代码。
solution:Upgrade mozilla firefox to a higher version than 1.5.0.3,0.8,0.9,0.9:rc,0.9.1,0.9.2,0.9.3,0.10,0.10.1,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.5,1.5:beta1,1.5:beta2,1.5.0.1,1.5.0.2,and avoid the version (,1.5.0.3],0.8,0.9,0.9:rc,0.9.1,0.9.2,0.9.3,0.10,0.10.1,1.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.5,1.5:beta1,1.5:beta2,1.5.0.1,1.5.0.2; Upgrade mozilla seamonkey to a higher version than *:beta,1.0,and avoid the version *:beta,1.0